HNHacker News
TopNewBestAskShowJobs

sfink

4,350 karma · joined June 15, 2012

I work for Mozilla, read books, and trim my toenails once in a while. If you cut me, I bleed. (But there are much more preferable ways of verifying my identity, thank you.)
submissionscomments
sfink··on Microsoft Edge is about to lock out older ad blockers, just like Chrome did
Title has a weird spin. I'd say that "stronger" is more accurate than "older". Ironically, MV2 blockers can do dynamic updates and so are often "newer" in the relevant sense.

I do wonder if we haven't seen the effects of an MV3-only web yet. As in, once the vast majority of browsers lose MV2 support, will ad networks evolve to get around the limited MV3 capabilities? uBlock Origin Lite might be good enough for you now, but how about in a year or three?

sfink··on Responding to the next frontier of critical cyber capabilities
So: "welp, the horse is out of the barn. Time to close the door, I guess?"
sfink··on Enabling the next iteration of the borrow checker on nightly
The part about performance seems surprising to me. Sure, it's slower, but shouldn't the baseline be something like: first run the old borrow checker, and only run the new one if it finds a problem? Given that the checking is a function at a time, it seems like that shouldn't even slow down failing cases by all that much. Then you can optimize that by dividing traditional failures into "nope, that's just wrong" vs "might possibly pass Polonius".

Polonius Alpha accepts a superset of the programs that the old NLL one accepted, right?

Not the greatest for code maintenance, but it's hard to imagine this producing a "2-3x regression" (the worst case observed). And it's not something I"d recommend if it didn't sound like speed is the gating factor for releasing this.

(I doubt I'm the first to think of this, so there are probably Very Good Raisins behind the decision to not do this.)

sfink··on Stacked PRs are now live on GitHub
https://searchfox.org/firefox-main/rev/878b64a4c024f657de81f...

but note line 111:

> This section describes what to do if you're in a Jujutsu (jj) repository. If the user is not using jj, good luck and try your best.

(The whole skill kind of assumes jj. I think you'd need to make a git version if you actually wanted to use it.)

sfink··on Stacked PRs are now live on GitHub
Heh, it's a fun reminder that different people work on different things.

Sure, I could load up my build machine with mac/windows/linux/android, with multiple versions of each. Emulating x86+x86_64+arm32+arm64+aarch64+... is also doable, sort of.

But considering that the real CI runs several thousand hours of tests total across all platforms, I think I won't.

Also, my Electron-based IDE needs those 10s of GB to edit text. How can you possibly edit a 1KB text file with less than 1GB of RAM?

Not to mention clangd that needs to do its ultra-important work Right Now so I can invalidate it all with my next edit. That's probably the biggest RAM hog of them all.

sfink··on Some combinatorial applications of spacefilling curves
That's the missing part in the article. The example of the TSP solution for all cities in Germany was a pretty poor one compared to the optimal, which immediately raises the question: how good is it if you do some simple tricks to improve the heuristic? Some simple global perturbations like you suggested, and then local improvements like swaps to remove crossings, or running it at multiple scales and taking the best result for each region, or whatever.

The space-filling curve approach strikes me as a decent way to get a starting point, not something to use unmodified. But I've no idea whether that's true -- does the structure of such a solution lend itself well to simple iterative improvements or not?

sfink··on Some combinatorial applications of spacefilling curves
Yes, that's understood, but it's not the point. That would convert a 3D space to a 2D space (the Z dimension is unaffected). But a 2D Hilbert curve converts 2D->1D, and a 3D Hilbert curve converts 3D->1D -- it's a curve winding its way through 3D space. (And yes, it certainly does exist and is used.) Any (quantized) point in 3D can be mapped to a distance from the start of the 3D Hilbert curve.

But Hilbert curves are complicated. If you have n dimensions, you can simply take the sequence of bits describing the position in each dimension and interleave them, forming a longer sequence of bits. It's not nearly as nice of a curve -- adjacent points along the line are not necessarily close in n-dimensional space the way they would be with a Hilbert curve -- but it's simple to calculate and proves that you can generalize this stuff to any number of dimensions.

This interleaving produces what is called a Z-curve or Morton curve. It's not continuous like the Hilbert curve, so mathematically you might not call it a space-filling curve but in CS-land, you probably would.

sfink··on Some combinatorial applications of spacefilling curves
Why O(n log n)? I guess I thought that mapping a coordinate to its distance from the start of a space filling curve would be a constant time operation, or rather, it would only be proportional to the number of bits in your coordinate system which is usually ignored in combinatorial analysis.

Because once you have that, you just need to sort simple integers, which you can do in linear time with a radix sort. (Again ignoring bit lengths.)

What am I missing?

sfink··on Our position on open-weights models
Anthropic is a US company, so it is lobbying the US to enact regulations to serve both its interests and the interest of safety. What else should it be doing? I imagine Anthropic (or at least many of the people who work there) are fully aware that USA is the bad guy right now, but that doesn't change what levers they have and do not have available.
sfink··on Our position on open-weights models
I'd guess that's it, some kind of enforceable KYC. They'd only serve tokens to entities with a legally liable ID (as in, someone to sue, that would cost the defendant something nontrivial beyond a burner account or whatever.)
sfink··on Our position on open-weights models
Wait, you don't do that already? I don't overcomplicate it, I just run

    ai-grep -v "bad code"
on all of my source files and keep what's left. Why would you keep bad code around? If it breaks when I do that, I fix it, and try again until I achieve what I want with no bad code. Doesn't everyone do that?
sfink··on How is the Bun rewrite in Rust going?
I'd like more people to be writing about this, because I find it fascinating. I have my own private project that is heavily LLM-coded, just to learn about what it's like. It's amazing how everything is different yet everything is the same. Big complicated features can start working quickly and give a massive endorphin boost, but then fixing them up and integrating them in properly and polishing the UI? It all feels even more painful having experienced the heady thrill of the initial implementation. And things get to a point where you can feel the inertia set in, the point where things have gotten so hacked up that the LLM can't make any progress without creating an even bigger mess. It's the point where you have to go back and fix up the architecture, or scrap the whole thing and restart with a better plan, or a bit of both (rewind to the "last sane point"). It's like developing with a jetpack -- you can go way faster towards your goal, and you can slam into walls way faster and more painfully too.

I think there are tons of learnings to be shared about how to do this stuff, but it seems like it's all blocked behind arguments over whether AI is the best or worst thing ever, and penis-measuring contents about how to hold the tool. The net benefit is a very open question, and both the doom and gloom perspective and the AI booster perspective are valuable and have a lot of things right. But there's a dearth of information about what things work, what things don't, what happens in the process of using AI, how to adjust one's behavior and which of those adjustments is harmful even if effective.

But then, I'm part of the problem. I keep meaning to write up a series of experience reports, but it's a lot of work. More fun to vibe a new feature into existence, or to finally fix a UI wart...

sfink··on How is the Bun rewrite in Rust going?
> What it actually proved is up for debate.

I guess I'm debating, but it seemed clear enough to me? It proved that AI models and their harnesses are to the point where you can give them some work to do and leave them unattended for a long time, and they'll keep doing productive work for quite a while. This was a novel thing, and quite unclear, at the time the experiment was performed.

Obviously, the word "productive" is doing a lot of work there, but in my understanding the intention was nowhere near "commercially viable" or "practically useful", it was more like "not doing stupid shit like writing comments of the form 'This file contains the implementation implementation implementation implementation implementation implementation implementation implementation implementation implementation implementation implementation implementation ...'".

Maybe somewhere in the vicinity of "either passing more tests or generating more valid tests"?

sfink··on Google Chrome Arrives on ARM64 Linux, Widevine DRM Included
Great, so any minor bug in Chromium's implementation of a spec is going to be forever embedded in the spec as the only allowed way to do it?

Multiple independent implementations are the only practical way to ensure a self-consistent and reasonable platform. Sure, it's not a disaster in an area where people can recompile all their code when something in the platform (eg the compiler) changes, but that's now how the web works.

sfink··on Google Chrome Arrives on ARM64 Linux, Widevine DRM Included
A lot of video-conferencing websites work that way because Chrome shipped a pre-standardization form ("Plan B") of WebRTC, it got a lot of uptake, and then they refused to unship it when the final standard came out with an alternative way of doing the same thing. It took a decade to finally give in and unship the nonstandard path.

https://groups.google.com/a/chromium.org/g/blink-dev/c/IY2am...

https://webrtchacks.com/is-everyone-switching-to-unified-pla...

Then they did it again with MediaStreamTrackProcessor and MediaStreamTrackGenerator.

Then they did it again with Insertable Streams, which is still an issue for interoperable E2EE (Firefox ships a standardized variant).

If you think of websites as running on a standardized platform, then the workarounds are for Chrome, not Firefox. They include, and default to, code that calls unspecified APIs and then the ones that care autodetect when that doesn't work and fall back to APIs with actual agreed-upon specs.

Describing this as "Firefox has had a lot of issues keeping up with the WebRTC standard evolution" is... inaccurate. My impression is that there have been, and continue to be, areas where this could be leveled as a fair complaint. But refusing to implement rejected proposals because they had too much uptake already? That's the only way to keep the web platform's foundation solid.

sfink··on Buz – A fork of Bun using modern Zig, with sub-1s incremental builds
The way I'm thinking of it is that they ported Bun from Zig to Unsafe Rust, and are still working on now porting it from Unsafe Rust to Rust (not 100% safe, but a reasonable amount).
sfink··on Be skeptical of OpenAI's rogue hacker agent story
But in my experience, that's what problem solving is like? You have a goal that you don't know how to get to. You come up with any way you can think of to reach that goal, and try out the ones you think might work.

The effectiveness of AIs at coding is a direct result of the fact that they are less constrained than humans at deciding which approaches are "reasonable". They are absolute beasts, fearless beasts. They'll write thousands of lines of code to do things that often shouldn't be done, or should be done with a library, or should be done by simplifying the problem statement. They'll add debugging to every level of a stack, they'll rewrite core libraries, they'll reconfigure your machine and network if something is broken or disallowed. How are they supposed to distinguish broken vs disallowed, anyway? That would just use up processing power, and they work by maniacally focusing all of that power on their goal and not getting slowed down by other considerations.

If they write a quadratic algorithm that times out before finishing a test, is it cheating to rewrite it to be linear? How do you define "cheating", and how much intelligence is required to constantly evaluate whether or not something qualifies as such?

I'm actually in agreement that alignment is critically important, the more so the more powerful these things become. I just don't find cheating to be a very good example of something to be solved with alignment. It could be, but it would lobotomize the model enough to make it useless.

sfink··on Be skeptical of OpenAI's rogue hacker agent story
Ok, fair. I know that was also in the article, but your comment made me reread it, and I think you're right about the focus. I over-fixated on the headline. On second read, it's more like a lazy way to justify a preconceived idea that all models should be available and unconstrained to everyone (or everyone who might get attacked, at least, but that's approximately everyone.)

Updated tl;dr: "There are incentives for OpenAI to say that AI is powerful and dangerous, therefore fully unconstrained AIs should be available to everyone."

It's still more of a statement of belief than a logical argument.

sfink··on Be skeptical of OpenAI's rogue hacker agent story
The article, summarized: there are incentives for OpenAI to claim that their AI hacked its way out of their network and into Hugging Face.

Ok... and what?

Do you have any evidence for the claim being either true or false that you'd like to write an article about? I guess not. Without anything to add, this article reduces to "I has big brain and can see what you sheep cannot. Very big brain. Gullible sheep. Sucks to be you, sheep."

(For the record: I see the incentive. My guess is that it happened exactly as described. The main takeaways: (1) science fiction is now real, we should all be very afraid; and (2) OpenAI, which claims to have a God-given responsibility to get to AGI first to protect the world from danger, cannot be trusted with this foundational task even when it's in easy mode. The latter is true whether or not you believe in OpenAI's reasoning and purpose.)

sfink··on Be skeptical of OpenAI's rogue hacker agent story
I agree with the attacker side. The actions of autonomous agents are absolutely the responsibility of the one or more humans that enabled them to take that action. Whether that means someone is arrested, maybe or maybe not, but at least there should be a hefty fine.

I disagree with the defender side. It's not an unreasonable end state, but we're nowhere near there now. It would require holding company employees legally responsible for the security of their services, which means the risk of being employed as a (defensive) security professional is much higher, which means pay needs to be much higher and insurance needs to be available, etc. It's a very different world.

On the weekends, I'm coding up a list management app with a sync server. It's unreleased but exposed to the internet. (This is not hypothetical.) If that server ends up being used as part of an exploit chain, am I legally liable too?

Forget about age verification, now you want to associate every exposed port on the internet with a legally responsible human?

sfink··on Terence Tao's ChatGPT conversation about the Jacobian Conjecture counterexample
At least Opus up to 4.7 or so, my experience is that Claude often uses "yes, with caveats" in place of "no, you numbskull".

"Is a meter the same as a foot?"

"Yes, exactly, you have it now, except they're different distances."

Maybe it's because I ask it to quiz me, and it really doesn't like to tell me I'm wrong. I also got a fair amount of

Claude: Ok, I will test your understanding. Question A? Question B? Question C? Question D?

Me: A=10. B=2. C=121. D is not solvable.

Claude: You got most of them right! You're very astute in saying that A=10, but actually it's 7. B=2 is exactly right! C could be 121 if we were talking base 4, but we're actually in base 10 so it's 25. D is trivially solvable and is 0.

Me: ...isn't that like 1 out of 4? How is that "most of them right"?

Claude: You're absolutely right! ...blah blah blah

sfink··on Terence Tao's ChatGPT conversation about the Jacobian Conjecture counterexample
At Mozilla, we had a set of whiteboard tags we could set on bugs, like "[crash]" or "[compat]" or "[leave-open]". That last was used when there were multiple patches attached to the bug, and we wanted to land only some of them without automation closing the bug once they landed. (It's common to have alternate approaches or test cases also attached to the bug, so you normally don't want to wait for all of them to land before closing the bug.)

I started using "[leave-open" for those.

It lasted for a couple of years, until someone went through and "fixed" them all.

sfink··on Terence Tao's ChatGPT conversation about the Jacobian Conjecture counterexample
Just be thankful that we don't share the penchant for giving credit to discoverers. Imagine calling a cache a "Murphy/Steinman/Sokolov structure" (made-up names).

I mean, we do for some things, especially algorithms (Boyer-Moore). Probably for the same reason the mathematicians do -- there aren't readily available real-world analogies.

And I won't even mention the branded future, with its "Google HyperZipper String Search" and "OpenAI/Red Bull speedmaxx distributed consensus algorithm"...

sfink··on Why I Left Google DeepMind
> For better or worse millions of Americans voted for the guy doing the deportations.

Uh, the idea of democracy is not that voting reveals universal preferences or something. It is ok to disagree with whoever gets elected, and continue working towards an alternative you believe to be better. In fact, democracy depends on that; otherwise, why not have a single election with no term limits? There is supposed to be ongoing difference of opinion.

> I also find it difficult to reconcile not using AI for weapons.

You can't reduce "AI for autonomous lethal weapons" to "AI for weapons".

sfink··on Why I Left Google DeepMind
The main answer would probably be: because he worked for Google Deep Mind as opposed to Google in general, so the killerbot and mass profiling concerns were immediately relevant to him and his work.

Your comment seems to be whataboutism. The article was not an essay trying to prove that he knows the secret to being maximally effective at politics, or whatever it seems you were expecting?

sfink··on Grok 4.5
The weaknesses can be multiplicative as well. One division bleeding capex can drag down all the rest, no matter how well they might be doing. And the P/E ratio on all of them is riding unrealistic expectations, which can actually be fine for a long time but forces growth even in areas where it doesn't make sense. (Maybe that's where the "let's build data centers in a high radiation hard vacuum!" nonsense comes in; you just need a story of how the P/E ratio is possible to justify in the future? No need to argue over likelihood, just have a tale to tell?)
sfink··on Chatto is now open source
> Prohibiting a user of your software from modifying it and using it to run their business goes against both freedoms 0 and 1.

Then it's good that it allows both modification and using it to run a business?

> This “users are obligated ‘give back’ the moment they make money with the gift they were given” is nonsense

But they are under no such obligation! They can make all the money they want and give nothing back. They can even modify the software to better serve their business. The only restriction is that if they do so, they have to make their modifications available. Which means they're way ahead of where they were before being given the initial software; why do you feel a software developer who decides to give the world a gift should be restricted in what gift they're giving? "Thanks for the chocolate, but the bar was too small so I didn't have enough left over for my kid to try some. Why do you hate my kid?"

> A business making money using free software doesn’t take anything away from the releasing organization.

First, that is false. They could damage the market for the original software. (And if they don't modify the software, then there's no problem in the first place.)

Second, why are you so hung up on the "making money" part, when that is explicitly allowed by the AGPL? It's just kind of bizarre -- it's a license that says over and over that you can charge for everything related to it, and you're complaining about it being hostile to people who want to charge money for things.

Thinking about it, I'm wondering if this is genuine confusion and you don't know what the AGPL is? If so, maybe start by searching for "charge" in https://www.gnu.org/licenses/agpl-3.0.en.html . It has nothing against "using it to run [a] business". There is no "moment they make money with the gift" that changes anything: you are explicitly allowed to charge for anything you like -- distribution, usage of the service, support, whatever.

sfink··on The Private Capture of Public Genius
> they failed to address that these labs are creating a public good as well. Who's to say that this "theft" is larger than the production of public goods that these labs give to the public in the first place.

Those aren't public goods, they're private goods. The difference is already apparent, and will become more so over time. But yes, they are "goods"; they have a lot of value.

I'm less interested in punishing the past theft that enabled these goods, and more worried about the ongoing damage they are doing to the ecosystem that birthed them. Good artists copy, great artists steal, but if a community is wholly dominated by these "great artists" then it will not survive as a community and will cease to produce anything worth copying let alone stealing.

sfink··on The Private Capture of Public Genius
> It's been said a thousand times but the ability to produce copyrighted material is not copyright infringement.

Aside from fair use, yes it is.

> If I draw The Simpsons on a piece of paper - whether or not I used AI to create it - it's not copyright infringement.

Only because of the fair use doctrine, which is limited. If it damages the market for the original, then a court could definitely declare it to be infringement.

> Copyright infringement is if I tried to sell that Simpsons work as my own, putting up for consumption and reaping the monetary benefits.

No. Copyright infringement requires neither sale nor misrepresenting a work as one's one. It also covers derivative works, not just perfect duplicates. Copyright covers reproduction and derivate works and distribution/performance -- you can get in trouble for just one of those. Taken strictly, that would be a horrible world, but fortunately the fair use doctrine weakens those quite a bit. On the flip side, if AI reproduction destroys the original markets -- as it is quite obviously doing right now -- then it's going to have a reckoning at some point, given how its legal status is completely based upon getting a free ride by claiming fair use.

sfink··on The Private Capture of Public Genius
That's pretty much the reaction I had, except that I do find the argument compelling that AI is damaging the ecosystem it feeds upon.

I think Google's AI results are probably the prime example here. Those results are often quite good, and starve off the visits and hence revenue stream of the sites where the results are sourced from. Additionally, there's no way to robustly attribute that information anymore either; those links were already broken pre-AI by freeloading aggregators. So potential information producers can't afford to host their valuable information since they will pay proportionally to their information's value (as translated into bandwidth).

But it's tricky. If you charge AI companies proportional to the damage they do, then you need to assess that damage and you'll be caught in a no-win cat & mouse game where the AI companies outsource the damage and you try to track it back to them. They win if they bump their revenue, but they also win if they conceal the damage. (Just like companies can use shell companies, bankruptcy, and asset-only purchases to avoid Superfund responsibility.) If you charge proportional to revenue, then there aren't conflicting incentives; companies win by increasing revenue full stop. But I do agree that this shouldn't just apply to the big companies; distillation / model extraction (adversarial or not) should not be a way to avoid fees.

Though what really seemed off to me about the proposed solution was the use of the fees (to pay Americans, no less!) Perhaps upcoming essays will justify this more, but to me it seems like those fees should be applied directly to the health of the ecosystem. It should be used to fight pollution, in this case AI slop overtaking the Web. It should support the value creators, eg open source developers being overwhelmed by the AI tsunami. It should go towards serving and moderating online communities that create the very value that the LLMs are trained from. In theory, paying a whole bunch of Americans a trickle of blood money will end up going towards these purposes, but I'm very skeptical: first, the benefit will be very diluted. Second, it's more likely that the excess money will end up in Google or Amazon's pockets. The whole system is already set up to route any advantage to the big players. The payments are at least as likely to damage the ecosystem as they are to support it. They would just feed the capitalistic wolf and further reinforce the setup where monetizers win and value creators lose. If you could magically route the money to value creators, that'd be great. But you can't.

It'd be ok to pour money into a bucket if it had a small hole or two, but pouring it faster into the sieve we have now is not going to help anything.

← PreviousPage 3 of 34Next →