HNHacker News
TopNewBestAskShowJobs

raggi

2,842 karma · joined December 24, 2009

submissionscomments
raggi··on Installing UEFI Firmware on ARM SBCs
They don’t have exactly the same coverage. UEFI provides a standard set of APIs, some optional, some mandatory. It also specifies a boot path via gpt and efi system partitions.

A common secondary piece is ACPI, which isn’t strictly mandatory, but when you provide both UEFI and ACPI then you can skip the whole dtb mess. Sadly ACPI isn’t the simplest of approaches, as it’s encoded in a way that requires executing bytecode in a stack machine. There are real and valid security concerns that come with this, but there are also big advantages- the abstraction generalizes over a lot of what would otherwise be specialization that has to be carried around in the bootloader and OS.

Uboot implements a subset of the uefi spec, but typically is used where there is no ACPI type configuration, with the gap filled by a combination of dtbs and vendor forks or patches (often before upstreaming, which sometimes never happens).

Depending on how deep your relationship is with all of this, you may live with uboot as a plain binary blob from a board vendor, in which case whatever version they formed and options they chose may bring various constraints or challenges doing anything novel like booting an alternative kernel or distro.

Typically a more complete uefi and ACPI system will be able to get much further in the boot process with far less hardware specialization, a lot of operating systems can boot very far with this combo even if they’ve never seen the specific hardware topology before.

Uboot upstream has a lot of implementations for a lot of hardware targets. There isn’t really so much of a central place for uefi implementations

raggi··on Installing UEFI Firmware on ARM SBCs
what areas of u-boot do you find much simpler than edk2?
raggi··on Installing UEFI Firmware on ARM SBCs
There is a UEFI standard in some of Arms specs, but it’s only mandatory for the server class IP atm. Some soc vendors are starting to adopt it even in non-server class but it’s slow. My feedback to an Arm devrel a few years ago was exactly this though: you need to provide a consistent standard boot path that also helps OS authors with enough bootstrap that debugging is less of a crapshoot every single time. I hope some progress is made on pushing that down the stack.

When the topic comes up some people express a lot of hatred for uefi (mostly users rather than implementors) but where it’s implementors the ms style APIs and so on are largely the center of it IME, and that’s not really an easy fix when it’s already spec’d. Sometimes there are concerns about size, but slimmed down deployments are common in the socs that ship already - perhaps standardizing on what that slimmed down thing is might help too. May also assuage some of the other concerns of excessive runtime services (which seems rare, but I get the existential concern)

raggi··on John Carmack's arguments against building a custom XR OS at Meta
Customers not being able to tell that it happened was a goal of that deployment.

It wasn’t anywhere near that late the numbers you’re saying was about the whole build cycle - board bringup for one of the two boards first commit in zircon was 3y before launch (that codes public, I just checked and Mike landed it in 2018) - and discussions weren’t done then, that was before any prototype/demos could be done. There were sluggish stages and project management was rough, and there were delays at the end related to quality but the quality bar was necessarily high, particularly on the core system - don’t brick all the devices in the field. And we didn’t, and that’s actually a feat replacing everything from firmware to gui in the field without users noticing.

What was the goal? Well two things: fuchsia needed a first, and realistic shipping target that wasn’t excessively lofty. Nest needed to get out of the OS game so it could focus resources on product. Chris talked about this in his 9to5google interview.

It’s a shame you feel so sour about it, everyone involved did good work. I have friends from nest and some of the ics also have similar pained history from that time - it’s sad, once upon a time it was maddening. It’d have been so easy for a leader to substantially improve that. Sure plenty of things could have been better, for sure we could have fixed these awful sentiment and relationship issues (I tried, got burned for it - that even showed up in my calibration), but we all shipped.

raggi··on SQLite's documentation about its durability properties is unclear
fsync is rarely truly durable in the sense the article describes. it does help with loss ordering in a lot of cases, and flushes often do some work, but true durability, the idea that after fsync there will not be any rollback or tail loss unless there's catastrophic failure, sorry, nope. everyone in the chain ends up in the hot path being the hotspot, then they break it because y'all are addicted to spamming syncs then they move it to a new api, then slowly the syncs come back on the new api, then everyone moves again layer by layer. somewhat common examples in recent years are nvme vendors who implement nvme flush in terms of just pushing the write cache down, but won't always also finalize and flush in flight or scheduled ftl operations due to the insane worst case latency costs associated. weren't apple also caught doing the same in recent years, in part because their ftl shared memory, bus and privilege with the higher exception levels? there's also the rumors people say about enterprise drives being better here, but not doing so is even a saleable product in those environments: https://www.atpinc.com/technology/ssd-flush-cache-technology and some other vendors just have arbitrary firmware patches to compete (that is: you could buy "enterprise grade" hardware second hand and be entirely unaware of the actual command behavior).
raggi··on John Carmack's arguments against building a custom XR OS at Meta
Yeah, the various docs and presentations given by reversers on the details of nintendos os really showcase a lot of good design choices. An impressive amount of work for just trying to enforce a harder IP moat around entertainment software.
raggi··on John Carmack's arguments against building a custom XR OS at Meta
Just overclock (more) the system that’s already in a severe struggle to meet power, thermal and fidelity budgets?
raggi··on John Carmack's arguments against building a custom XR OS at Meta
For this use case a major one would be better models for carved up shared memory with safe/secure mappings in and out of specialized hardware like the gpu. Android uses binder for this and there are a good number of practical pains with it being shoved into that shape. Some other teams at Google doing similar stuff at least briefly had a path with another kernel module to expose a lot more and it apparently enabled them to fix a lot of problems with contention and so on. So it’s possible to solve this kind of stuff, just painful to be missing the primitives.
raggi··on John Carmack's arguments against building a custom XR OS at Meta
By forced I guess you’re referring to the room full of leads who all said yes, but then reported otherwise back down to their ics to avoid retribution. I caught early wind of this from folks being super rude in early on the ground discussions and tried to raise it with Linus. One of the directors got his kickers in a twist and accused me of making a mountain out of a molehill. I guess clearly not, as the sentiment and division still stands.
raggi··on John Carmack's arguments against building a custom XR OS at Meta
I think what op was thinking of was early harmonyos, seen people confusing those a lot. Harmony now ofc isn’t what
raggi··on I Am An AI Hater
Extremism and division aren’t a path to wisdom or to healthy cultures, but you do you.
raggi··on macOS dotfiles should not go in –/Library/Application Support
I guess while I’m here, please stop putting generated stuff in .config or even worse junk you downloaded, half of you without even checking it’s the right content or having any docs, ui or ux for cleaning up.
raggi··on macOS dotfiles should not go in –/Library/Application Support
The thing that annoys me more than the authors main complaint is when the XDG specs are ignored on windows and macOS (I.e. if XDG vars are set, respect them). I work on all platforms, I have decades old dot files that work on over 9 different operating systems that I have used extensively. Some programs force maintenance work I’d rather not. Another peeve in this space is programs that force absolute paths (worst offenders are the ones doing it for security theater, diaf gpg) or that lack any mechanism for platform or local overrides.
raggi··on Show HN: JavaScript-free (X)HTML Includes
I used to do this in the 2000's era, there was a lot to love about it. At the time though the IE engines were far more complete and less buggy than others with various XML features.
raggi··on Benchmarks for Golang SQLite Drivers
fwiw, the tailscale fork of Crawshaw’s library has a good number of allocation removals and other optimizations, but cgo is still expensive.
raggi··on AI tooling must be disclosed for contributions
No. I don't think "novelty" would be relevant in such a case. How much risk you have depends on many factors, including what you mean by "use". If you mean sell, and you're successful, you're at risk. That would be true even if it's not the same as other content but just similar. Copyright provides little to no protection from legal costs if someone is motivated to bring a case at you.
raggi··on AI tooling must be disclosed for contributions
reddit is a user hostile company, have been forever, always will be. they take rights over your content, farm things about you, sell data, do invasive things in the mobile apps, use creepware cookies, etc.

Excerpt from the user agreement:

    When Your Content is created with or submitted to the Services, you grant us a worldwide, royalty-free, perpetual, irrevocable, non-exclusive, transferable, and sublicensable license to use, copy, modify, adapt, prepare derivative works of, distribute, store, perform, and display Your Content and any name, username, voice, or likeness provided in connection with Your Content in all media formats and channels now known or later developed anywhere in the world. This license includes the right for us to make Your Content available for syndication, broadcast, distribution, or publication by other companies, organizations, or individuals who partner with Reddit. For example, this license includes the right to use Your Content to train AI and machine learning models, as further described in our Public Content Policy. You also agree that we may remove metadata associated with Your Content, and you irrevocably waive any claims and assertions of moral rights or attribution with respect to Your Content.
People put their heads in the sand over reddit for some reason, but it's worse than FAANG.
raggi··on AI tooling must be disclosed for contributions
"an LLM" could imply an LLM of any size, for sufficiently small or focused training sets an LLM may not be transformative. There is some scale at which the volume and diversity of training data and intricacy of abstraction moves away from something you could reasonably consider solely memorization - there's a separate issue of reproduction though.

"novel" here depends on what you mean. Could an LLM produce output that is unique that both it and no one else has seen before, possibly yes. Could that output have perceived or emotional value to people, sure. Related challenge: Is a random encryption key generated by a csprng novel?

In the case of the US copyright office, if there wasn't sufficient human involvement in the production then the output is not copyrightable and how "novel" it is does not matter - but that doesn't necessarily impact a prior production by a human that is (whether a copy or not). Novel also only matters in a subset of the many fractured areas of copyright laws affecting the space of this form of digital replication. The copyright office wrote: https://www.copyright.gov/ai/Copyright-and-Artificial-Intell....

Where I imagine this approximately ends up is some set of tests that are oriented around how relevant to the whole the "copy" is, that is, it may not matter whether the method of production involved "copying", but may more matter if the whole works in which it is included are at large a copy, or, if the area contested as a copy, if it could be replaced with something novel, and it is a small enough piece of the whole, then it may not be able to meet some bar of material value to the whole to be relevant - that there is no harmful infringement, or similarly could cross into some notion of fair use.

I don't see much sanity in a world where small snippets become an issue. I think if models were regularly producing thousands of tokens of exactly duplicate content that's probably an issue.

I've not seen evidence of the latter outside of research that very deliberately performs active search for high probability cases (such as building suffix tree indices over training sets then searching for outputs based on guidance from the index). That's very different from arbitrary work prompts doing the same, and the models have various defensive trainings and wrappings attempting to further minimize reproductive behavior. On the one hand you have research metrics like 3.6 bits per parameter of recoverable input, on the other hand that represents a very small slice of the training set, and many such reproductions requiring strongly crafted and long prompts - meaning that for arbitrary real world interaction the chance of large scale overlap is small.

raggi··on AI tooling must be disclosed for contributions
In the US you can not generate copyrightable IP without substantial human contribution to the process.

https://www.copyright.gov/ai/Copyright-and-Artificial-Intell...

raggi··on AI tooling must be disclosed for contributions
For a large LLM I think the science in the end will demonstrate that verbatim reproduction is not coming from verbatim recording, as the structure really isn’t setup that way in the models under question here.

This is similar to the ruling by Alsup in the Anthropic books case that the training is “exceedingly transformative”. I would expect a reinterpretation or disagreement on this front from another case to be both problematic and likely eventually overturned.

I don’t actually think provenance is a problem on the axis you suggest if Alsups ruling holds. That said I don’t think that’s the only copyright issue afoot - the copyright office writing on copyrightability of outputs from the machine essentially requires that the output fails the Feist tests for human copyrightability.

More interesting to me is how this might realign the notion of copyrightability of human works further as time goes on, moving from every trivial derivative bit of trash potentially being copyrightable to some stronger notion of, to follow the feist test, independence and creativity. Further it raises a fairly immediate question in an open source setting if many individual small patch contributions themselves actually even pass those tests - they may well not, although the general guidance is to set the bar low - but is a typo fix either? There is so far to go on this rabbit hole.

raggi··on How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos
I know, but the _implication_ is that it's extremely unsafe, I don't buy the implication - code gets executed.
raggi··on How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos
I love this implication that there's some valuable body of code out there that gets reviewed, compiled and never executed.
raggi··on Show HN: Fractional jobs – part-time roles for engineers
These prices seem very low.
raggi··on Debian 13 “Trixie”
LTS has had major breaking changes in various areas in recent times too, virtio was badly broken at one point this year, as was a commonly used netlink interface. Hat tip to the Arch kernel contributors who helped track this down and chase upstream, as we had mutually affected users. The debian and ubuntu bug trackers were a wasteland of silence and user contributions throughout the situation, and frustratingly continued to be so as AWS, GCP and others copied their kernel patch trees and blindly shipped the same problems to users and refused to respond to bugs and emails.

You're right stability comes from testing, not enough testing happens around Linux period, regardless of which branch is being discussed.

It's not easy testing kernels, but the bar is pretty low.

raggi··on Encryption made for police and military radios may be easily cracked
"which is ostensibly AES" in the 5% or less of deployments that turn that on

Both of the systems are crap, when we were evaluating them for nationwide purchase we chose TETRA because of systemic safety features (like local DMO handover modes for public safety use in noisy environments), but when I read their crypto choices I made screwy faces constantly, I wasn't in the slightest bit surprised when this research came out.

I remember at the time some ex signals military folks trying to tell me that the encryption barely matters as the channel selection rate is so high you'd need multi-site intercepts to even make heads of tails of it, sadly they didn't really seem to understand how far SDR and compute has come. The whole experience to this day flavors a lot how I think about military and telco thinking around the whole space, everything touching that boundary feels infected with oldthink.

raggi··on I know when you're vibe coding
This is a story of a bad LLM user (in this context), which is perhaps implied by “vibe coding” but folks should be aiming higher. Making people review slop is lazy, rude and disrespectful.
raggi··on AI coding tools can reduce productivity
Your response implies the ai produced code was landed without review. That’s a possible outcome but I would hope it’s unlikely to account for the whole group at this scale. We’re of course still lacking data.
raggi··on AI coding tools can reduce productivity
They averaged producing 47% more code on the AI tasks, but took only 20% more time. The report here biases over these considerations, but I’m left wondering: was the extra code superfluous or did this produce better structure / managed debt better? If that extra 47% of code translates to lower debt and more consistent throughput over the long term, I might take it, given how crushed projects get from debt. Anyway, it’s all hyperbole because there are massive statistical differences in the outcomes but no measures as to what they mean, but I’m sure they have meaning. That meaning matters a ton.
raggi··on Brut: A New Web Framework for Ruby
This reminds me of Camping without the dynamic parent class constructor.
raggi··on Too Many Open Files

        use std::io;
        
        #[cfg(unix)]
        fn raise_file_limit() -> io::Result<()> {
            use libc::{getrlimit, setrlimit, rlimit, RLIMIT_NOFILE};
            
            unsafe {
                let mut rlim = rlimit {
                    rlim_cur: 0,
                    rlim_max: 0,
                };
                
                if getrlimit(RLIMIT_NOFILE, &mut rlim) != 0 {
                    return Err(io::Error::last_os_error());
                }
                
                rlim.rlim_cur = rlim.rlim_max;
                
                if setrlimit(RLIMIT_NOFILE, &rlim) != 0 {
                    return Err(io::Error::last_os_error());
                }
            }
            
            Ok(())
        }
← PreviousPage 6 of 25Next →