colinmarc

Yeah, that was my original point.

IANAL.

Here's a random example from the Skyrim EULA:

   [You may] use one copy of the Software for your personal, non-commercial use on a single home or portable console or computer.
   ...
   [You agree not to] use or install the Software (or permit others to do same) on a network, for on-line use
   ...
   Installation on a network server is strictly prohibited, and this Agreement shall not serve as a network license in any manner.

Some independent developers have stated they don't like that the experience is degraded on GeForce now (because of latency, control bugs, etc). They prefer that users are running the game in a way that they've tested themselves.

This is somewhat incorrect.

It's a bit of a grey area, and it's not true that Nvidia needs to have a licensing deal. It's definitely against the license terms you get when you purchase a game through steam to run it on arbitrary hardware, but most (at least EU) courts would probably hold that if you own a game, you can run it on any hardware you have access to.

What happened was that when Nvidia just got started, they had an opt-out framework (for developers) instead of opt-in. At the time, some game developers felt like Nvidia was profiting off of their work unfairly, and posted publicly about it, and there was a decent-sized backlash.

However, in the meantime, other competing streaming platforms have gone with opt-out and there hasn't been much of an issue around it. I think most developers have come around to the idea that it increases game sales.

I debated putting this editorializing in the title, but:

At $work we've been refreshing the Bun release page for days, wondering when they would push the fix. The PR with the change merged over 72 hours ago: https://github.com/oven-sh/bun/commit/ea6a2c7b7c98862627760d...

I'm not a security expert, but package managers seem uniquely vulnerable to MITM attacks.

I don't really see the point of spending $MM in tokens to create a software factory if you can't push security releases out in a timely fashion.

Lots of positive stuff in this thread which I won't bother repeating. Instead, I'll add a few ambivalent points:

- Today, a lot of functionality still in Docker has been upstreamed into the (Linux) kernel, so containers can be much simpler (and rootless). Docker is still carrying around some of that cruft, which is what makes it slower and heavier than Podman.

- As a devex technology, Docker/containers have been massively successful, but not as infrastructure. Containers never became secure enough to run multitenant workloads without some other form of isolation, so they ended up being redundant with KVM (or gVisor, or a similar second layer) in production a lot of the time.

That second contradiction led to lots of inefficiency. For example, on Google App Engine, for years when you ran a deploy it would create a VM just to run a single container.

Go is not vulnerable in the same way software using webpki is, because it generally uses the system trust store. However, this change is about golang proactively blocking the certs, so that even if your OS doesn't update, it still won't trust them.

https://github.com/golang/go/issues/82345

TL;DR:

The very urgent uv/certifi/etc releases (and yet-to-be-done bun release) are about removing the compromised CAs as described here:

https://emudhra.we-have-a-problem.com/

In other words, that software bundled the compromised certs into the binary, so upgrading it is the only way to remove them.

This is about Go proactively blocking intermediates. Which shouldn't strictly be necessary as long as your OS has removed or distrusted the CAs (on my laptop, macOS has done that, although it seems like it did so in a way not all tools have access to; for example, rustls-platform-verifier respects it, but rustls-webpki still loads the bad CAs from the system trust store).

edit: forgot I can't use code blocks on HN

The eMudhra CA compromises had nothing to do with LLMs? But I love the vibes.

Thank you for engaging with my point! I agree, actually. I think if good design patterns could simply be copied out of a book, LLMs might be better at software engineering.

My point is more about up-front investment paying dividends. To speculate, it seems like the reward hacking is not there for long-term thinking.

Good interface design allows extending or changing component X without having to step on the toes of your colleague working on component Y downstream. It's absolutely essential.

Interface design is one of the things Claude is worst at in my experience (using it every day for the past year).

Code quality - and its best friend, interface design - pay dividends in large codebases. The fastest moving and most effective organizations I've worked at are ones that focused on code quality from the beginning.

All software is broken, but LLMs seem to make the wrong compromises consistently when working in large codebases.

It's trivial to bypass this by tweaking the system prompt in other harnesses. They use string matching and a blacklist.

https://x.com/FlorianKluge/status/2041855675295318039

(Whether that's against the ToS is not clear.)

Nothing good can come of "hacking" our natural inclination to trust other human faces this way.

Would this work with video compression? Video codecs encode a lot of meaning; they use motion vectors to track the movement of objects on screen, for example.

What's interesting to me about this is that it targets Claude's specific tics. Anthropic has created model that reliably reaches for the same tools (yes, and phrases; `python -c` is a load-bearing tool for it). Everyone gets the same model, so by learning the model's behavioral patterns you can target it better.

I'm a big fan of iroh, but I think iroh's holepunching algorithm is at least partly based on tailscale's, so it's not 100% accurate to say iroh got there first. (Just the "as a library without a control plane" bit.)

Came here to post the same thing. DataFusion is fantastic.

...funnily enough, a few hours after posting this, it stopped working.

I use my Anthropic subscription with Pi. I thought they would start charging me API usage at some point, but it never happened. (If it did happen, I would switch to open weights models.)

It's conventional for semver to allow breaking changes for 0.x minor releases (but not for patch releases).

I find it works a lot better at smaller sizes.

I use my Anthropic sub with Pi. They keep saying they're going to disallow that and then walking back the decision. Or at least I think that's what's happening.

My absolute favorite modality is one I don't use all that much at the moment: Zed's edit completion.

If you're unfamiliar, it's like tab-completion, but it has a context that includes the edits you've made in the last few seconds, and it can predict around the cursor.

The model isn't advanced enough to understand complex tasks, but it has more the feel of the "crafting gun" in Subnautica or other survival crafting games, if that analogy makes any sense.

Personally I hate working with a chatbot - it's low-bandwidth and rage-inducing. If I could imagine a perfect workflow, it would be something like me whispering my train of thought as I program, and then pointing a very fancy "autocomplete gun" at the code.

I really like Orion, but I had to switch (currently trying Zen) because the 1password extension was so so broken. I know it's probably not their fault, but it really got in the way every day.

> Maybe the game has changed with LLMs, but its been a running joke that engineers will build a startup/product/library/thing only to then realize they can’t get any users and that marketing and sales are hard.

I agree with your premise, but you're still viewing this technology through the lens of "a successful product" versus "a successful piece of technology".

Plenty of open source projects stay open source and are popular without ever making any sales whatsoever. I'm not trying to project my own motivations on the Iroh team; they may want to build a product out of it. For me, though, the project has a lot of appeal already, because it exactly and excellently fulfills a technological need, not because they brought me in with a "it's x but for y" narrative.

It's primarily an open source library, not a product.

I don't understand why HN seems so concerned about nailing down its "value proposition".