HNHacker News
TopNewBestAskShowJobs

username223

4,136 karma · joined July 31, 2013

If I don't respond quickly, it may be because I'm some form of slow-banned. Moderation on this site is aggressive, capricious, and opaque.
submissionscomments
username223··on EchoLeak – 0-Click AI Vulnerability Enabling Data Exfiltration from 365 Copilot
This. We spent decades dealing with SQL injection attacks, where user input would spill into code if it weren't properly escaped. The only reliable way to deal with SQLI was bind variables, which cleanly separated code from user input.

What would it even mean to separate code from user input for an LLM? Does the model capable of tool use feed the uninspected user input to a sandboxed model, then treat its output as an opaque string? If we can't even reliably mix untrusted input with code in a language with a formal grammar, I'm not optimistic about our ability to do so in a "vibes language." Try writing an llmescape() function.

username223··on The librarian immediately attempts to sell you a vuvuzela
I use uBlacklist to get rid of Expert Sexchange and similar low-quality sites in search results, and it seems to work well enough.

An "advanced mode" supporting literal keywords (with and without stemming) and boolean operators wouldn't cost the search companies anything. I think supporting regexp search would be hard: do you search your index for fixed substrings and expand around them? I'm not a search person...

I don't think you'd need much in the way of machine learning to filter out the spam. There are relatively few third-party display ad servers and affiliate networks, and those are the main lazy ways to make money. There's no need to filter out all commercial content; just getting rid of the "passive income" bros would be enough.

username223··on The librarian immediately attempts to sell you a vuvuzela
> Putting "exact phrases" in quotes no longer seems to work. Then they added insult to injury by forcing you to +mandate a term otherwise they might just ignore it. Now that no longer works either.

I don't understand why they got rid of these escape hatches. Sometimes I want the "top" pages containing precisely the text I enter -- no stemming, synonyms, etc. Maybe it shouldn't be the default, but why make it impossible?

In my ideal search world, there would also be an option to eliminate any page with a display ad or affiliate link. Sometimes I only want the pages that aren't trying to make money off of me.

username223··on Apple introduces a universal design across platforms
I never worked for Apple, but I've used mostly Macs since System 6, and am feeling the same frustration with their software. Unfortunately their laptops are way better than anything else out there, so I'm forced to tolerate it. I ran Linux on a PowerBook for awhile, but it was janky, and it seems like that has not changed. OS X is still basically Unix, so I'll go on running the Unix stuff I need, and turn off the lickable distractions to the extent I can.
username223··on Apple introduces a universal design across platforms
> It honestly saddens me how far Apple has fallen.

Same. For just one example, consider how submenus work. You don't notice when they're done right, but when they're done poorly, they will disappear when you try to choose a submenu item, or stick around when you expect them to go away. Getting them right is subtle; Apple got them right, and plenty of web pages still get them wrong.

That's interface design. Flashy translucency effects are something else.

username223··on Apple introduces a universal design across platforms
They can't even make a webpage that doesn't have janky scrolling in Safari. And it prompts me to enable notifications? I'm not so optimistic about their new UI design.
username223··on AI Angst
... until spellcheck gets "AI," and starts turning correctly-spelled words into different words that it thinks are more likely. (Don't get me started on "its" vs. "it's," which autocorrect frequently randomly incorrects.)
username223··on AI Angst
> As an anology: Most people wouldn't want to dig through machine code/compiler output. At least not without proper tooling.

My analogy is GUI builders from the late 90s that let you drag elements around, then generated a pile of code. They worked sometimes, but God help you if you wanted to do something the builder couldn't do, and had to edit the generated code.

Looking at compiler output is actually more pleasant. You profile your code, find the hot spots, and see that something isn't getting inlined, vectorized, etc. At that point you can either convince the compiler to do what you want or rewrite it by hand, and the task is self-contained.

username223··on LLMs are cheap
> The market price of renting that compute on the market. That's fully loaded,

Sorry, I totally misread your post. Charging 80% on top of server rental isn't so bad, especially since I'm guessing there are significant markups on GPU rental given all the AI demand.

username223··on I used AI-powered calorie counting apps, and they were even worse than expected
It's not that consumers don't care -- it's that "they" (i.e. "we") have been beaten down.

Connect an image labeling API to the USDA's database of nutrients, make a slick-looking app, and you have a product. Pay for some marketing, offer a three-day trial after which you auto-bill for a year, make refunds as difficult as possible, and you have a business. At $30/yr, 10k subscriptions (deliberate or accidental) gets you $210k after app store commission. If you're lucky, you get bought out for even more. If not, you still made good money for not much work.

username223··on LLMs are cheap
It's addressed poorly.

> First, there's not that much motive to gain API market share with unsustainably cheap prices. Any gains would be temporary, since there's no long-term lock-in,

What? If someone builds something on top of your API, they're tying themselves to it, and you can slowly raise prices while keeping each increase well below the switching cost.

> Second, some of those models have been released with open weights and API access is also available from third-party providers who would have no motive to subsidize inference.

See above. Just like any other Cloud service, you tie clients to your API.

> Third, Deepseek released actual numbers on their inference efficiency in February. Those numbers suggest that their normal R1 API pricing has about 80% margins when considering the GPU costs, though not any other serving costs.

80% margin on GPU cost? What about after paying for power, facilities, admin, support, marketing, etc.? Are GPUs really more than half the cost of this business?

(EDIT: This is 80% margin on top of GPU rental, i.e. total compute cost. My bad.)

Guessing about costs based on prices makes no sense at this point. OpenAI's $20/mo and $200/mo tiers have nothing to do with the cost of those services -- they're just testing price points.

username223··on <Blink> and <Marquee> (2020)
Binary editing was/is good fun. I remember replacing "__gnu_warning" with "__gnu_whining" to quiet some dumb nannying around gets(). Yeah, sure, buffer overruns, but if I'm writing some throwaway program, I can just not overrun the buffer.
username223··on Musk-Trump dispute includes threats to SpaceX contracts
Well... Sure, he got Starlink approved for rural broadband funding and ended some NTSB investigations into Tesla's "suicide mode." But those things can be reversed with a quickness if he's no longer on Trump's side.

He also wrecked a lot more of the federal government that doesn't affect him one way or the other, and may have harvested a ton of data for his AI company. We'll see if anything comes of that.

username223··on The last six months in LLMs, illustrated by pelicans on bicycles
Interesting timeline, though the most relevant part was at the end, where Simon mentions that Google is now aware of the "pelican on bicycle" question, so it is no longer useful as a benchmark. FWIW, many things outside of the training data will pants these models. I just tried this query, which probably has no examples online, and Gemini gave me the standard puzzle answer, which is wrong:

"Say I have a wolf, a goat, and some cabbage, and I want to get them across a river. The wolf will eat the goat if they're left alone, which is bad. The goat will eat some cabbage, and will starve otherwise. How do I get them all across the river in the fewest trips?"

A child would pick up that you have plenty of cabbage, but can't leave the goat without it, lest it starve. Also, there's no mention of boat capacity, so you could just bring them all over at once. Useful? Sometimes. Intelligent? No.

username223··on Low-Level Optimization with Zig
I can't say I'm happy with "yearly broken backward compatibility," but at least it's predictable.
username223··on Low-Level Optimization with Zig
At least it's not just clownish version acceleration. They decided they wanted versions to increase faster somewhere around 2017-2018 (4.xx), and the version increase is more or less linear before and after that time, just at different slopes.
username223··on Hollywood Is Already Using AI (and Hiding It)
> If I was going to use AI to write my novel, I would literally be robbing myself of the pleasure of making it myself.

The same would be true if I were going to use AI to read it. If we just wanted to trade Clif Notes around, why bother with novels at all?

Cyber-Leo-Tolstoy types a three-page summary of "War and Peace" into ChatGPT and tells it to generate an 800-page novel. Millions of TikTok-addled students ask ChatGPT to summarize the 800-page novel into three pages (or a five-paragraph essay). What is the point of any of this?

username223··on I'm Wirecutter's water-quality expert. I don't filter my water
I don't understand your point. That $8/gal water next to the Starbucks checkout is not addressing a crisis when the baristas are rinsing out people's cups with equivalent water for free. The bottled water isn't next to the prepper-sized cans of dehydrated food in your supermarket.
username223··on I'm Wirecutter's water-quality expert. I don't filter my water
The fact that potable water is so cheap in the developed world that you can use a gallon of it to flush your toilet is a miracle of civilization. Filter it if that makes you feel better, but it's a waste of money, and a dismissal of a major achievement in public health.

But hey, at least it's not bottled water, which is basically tap water that has been put in a single-use plastic bottle and trucked across the country.

username223··on What “working” means in the era of AI apps
I think of it like Uber in the early days, when it was subsidizing rides to try to gain market share while ignoring taxi and labor laws until it could pay to change them. Uber's original plan was to bleed money until it could replace human drivers with robots, but that didn't work out.

The current AI companies are burning money with an exit strategy of replacing office workers with robots. If/when that doesn't happen, they'll have to jack up prices and figure out another business model. Uber had the two-sided market and network effects for a true enshittification play -- riders and drivers are both trapped -- but LLM companies haven't figured that part out yet. Do they go for ads once they have enough users and brand recognition? Hoard GPUs and training data (maybe through licensing deals) to create a moat?

Anyways, it's fun while it lasts.

username223··on Musk-Trump dispute includes threats to SpaceX contracts
> Usually this comes towards the end of a dictatorship.

It doesn't seem that way to me, e.g. Putin arrested Khodorkovsky (the richest man in Russia) in 2003. The way I see it, the politician needs the oligarch's money to gain political power, but then he has actual state power, including guns and the judicial system. At that point the oligarch has no purpose -- after all, the politician can just make new ones -- so it makes sense to cast him out or destroy him.

Trump could bankrupt SpaceX with the stroke of a pen and bleed Tesla dry by revoking EV credits. He could even try to revoke Musk's citizenship over (real or fake) issues with his immigration status in the past. If Elon thought he was buying the presidency in exchange for favors, he wasn't thinking things through.

username223··on Swift at Apple: Migrating the Password Monitoring Service from Java
That's the theory -- a compacting collector will reduce fragmentation and can put linked objects next to each other. On the other hand, a reference count lives in the object, so you're likely using that cache line already when you change it.

I don't know which of these is more important on a modern machine, and it probably depends upon the workload.

username223··on Swift at Apple: Migrating the Password Monitoring Service from Java
> Java has had AOT compilation for a while, so traditional GC and its massive overhead are no longer a strict necessity.

You mean it does escape analysis and stack-allocates what it can? That would definitely help, but not eliminate the GC. Or are you thinking of something else?

Thinking about it more, I remember that Java also has some performance-hostile design decisions baked in (e.g. almost everything's an Object, arrays aren't packed, dynamic dispatch everywhere). Swift doesn't have that legacy to deal with.

username223··on Swift at Apple: Migrating the Password Monitoring Service from Java
I remember the 2x rule from 20 years ago - do you know if things have changed? If locality is more important now, tracing GC might never be as performant as reference counting. Either you use 2x the memory and thrash your cache, or you use less and spend too much CPU time collecting.
username223··on Swift at Apple: Migrating the Password Monitoring Service from Java
It has been a long time, but I worked on GC at one point. My guess is that it’s the memory footprint (and loss of cache locality) that’s to blame. Copying or mark/sweep can be fast, but only if you give them lots of extra memory to accumulate garbage between GC passes. ARC does a little extra CPU work all the time, but it has good locality, and doesn’t need the extra memory.
username223··on My AI skeptic friends are all nuts
If calculators were unreliable... Well, we'd be screwed if everyone blindly trusted them and never learned math.

They'd also be a whole lot less useful. Calculators are great because they always do exactly what you tell them. It's the same with compilers, almost: imagine if your C compiler did the right thing 99.9% of the time, but would make inexplicable errors 0.1% of the time, even on code that had previously worked correctly. And then CPython worked 99.9% of the time, except it was compiled by a C compiler working 99.9% of the time, ...

But bringing it back on-topic, in a world where software is AI-generated, and tests are AI-generated (because they're repetitive, and QA is low-status), and user complaints are all fielded by chat-bots (because that's cheaper than outsourcing), I don't see how anyone develops any expertise, or how things keep working.

username223··on Can I stop drone delivery companies flying over my property?
True, the article is talking about Ireland, and I don't know what the current laws are there. But for the States, normal aircraft are supposed to stay 500 ft away: https://www.ecfr.gov/current/title-14/chapter-I/subchapter-F...

That's not true for helicopters and UAVs within sight of their controllers, but I feel sorry for the people who bought a house not near and airport, and now have to deal with a buzzing swarm overhead.

username223··on LibriVox
You're more optimistic about this stuff than I am, but I think I get your perspective. We have decent sentiment analysis, fluent text generation, and real-sounding TTS, so combining them will yield a pretty good reading. I agree that you're probably right when it comes to newspaper columns and magazine articles, but that's not on the level of a good audiobook.

To take an example, here's an iconic line from the Fellowship of the Ring:

> The wizard swayed on the bridge, stepped back a pace, and then again stood still. ‘You cannot pass!’ he said.

If you think that is a command, you should shout it like Ian McKellen in the movie. If you think it's a statement based on superior knowledge (see https://acoup.blog/2025/04/25/collections-how-gandalf-proved...), you should probably state it with certainty and fatigue. And if you're making a movie with a ton of crazy special effects and swelling music, you should probably make whatever choice goes best in that context.

Even if a model could make some consistent choice there, I wouldn't be all that interested, because the reader conveying their interpretation of the character to the listener is what matters. Sure, it might get enough Spotify plays to make some money, but it's not art.

username223··on LibriVox
Certainly TTS has improved a lot thanks to modern AI, but it simply doesn't have the information to improve beyond sounding like a human reading words fluently. A professional audiobook reader modulates his tone to reflect narrative mood, chooses voices for the characters consistent with their natures, etc., and transformer models can't do those things.

For an example of a professional audiobook, check out Rob Inglis' version of The Lord of the Rings.

username223··on Teachers Are Not OK
> 30 kids in a class is still insane.

It's also what happens when you can only hire that many teachers.

> The top level kids can be ignored as not-a-problem(giving up the chance to make little einsteins). The mid tier kids dont get the help they need to elevate; and so teachers are burnt out attempting to make failing kids try to pass. Everyone is lost.

I've been there, teaching programming at a decent university, and it's basically triage. The top students will indeed take care of themselves, and the bottom ones are beyond help. Your job is to encourage the top when you can, but mostly to teach the middle, and help those at risk of falling into the bottom. It's grim, but it's the best you can do.

← PreviousPage 7 of 34Next →