HN user
threat research ∪ data science ∪ engineering
x.y@z.com where x=kcl y=fcb z=gmail
That isn't what the data shows, but we don't need to discuss it further. My reply was to the person interested in learning from other Postgres OLAP designs. This stuff is all pretty immature though and I wouldn't actually build on it outside of some very narrow, well-understood workloads.
I'm aware he edited it, but the original version isn't wrong, either. Just like Jarred's
We fuzz Bun's runtime APIs 24/7 using Fuzzilli, the JavaScript engine fuzzer used by V8 & JavaScriptCore
isn't wrong, even though that was only being done for the last 5-6 months of Zig Bun, and not the previous 5 years when they were accruing all of their tech debt.
pg_mooncake (now effectively abandoned due to being acquired by Databricks, but still up at https://github.com/Mooncake-Labs/pg_mooncake) pulled the DuckDB engine into Postgres wholesale, if I remember right.
pg_lake also uses DuckDB but keeps it external, routing through Postgres and managing Iceberg tables (but not the data itself) there (https://github.com/Snowflake-Labs/pg_lake).
Both of these were neck and neck with ClickHouse last time I tried them.
The Fuzzilli PR was merged on Nov 20. The acquisition was announced on Dec 3. A big holiday was in the middle.
The teams no longer interacted after the acquisition, and in prior interactions the Bun team would've been correct in saying they weren't fuzzing.
So Jarred isn't wrong, and Andrew also isn't wrong.
Is there a Yoda skill? -> A Yoda skill, is there?
There is a Yoda skill. -> A Yoda skill, there is.
I'm generally skeptical of causal narratives like this, but Naroditsky talked openly and at length about the ongoing physical and mental health effects of Kramnik's nonsense. So in this particular case, I'm comfortable blaming Kramnik either way.
“we really do not want any distraction now, if you feel that strongly you can always send an unsolicited term sheet to the board to consider”
Nope, don't do that. If you receive a credible term sheet at a meaningfully higher valuation, you'll have to rerun your 409A, even if you don't take the investment.
Are you under the impression Socrates wrote anything in the first place?
Experienced business travelers want to use their personal credit cards so they get the points, and scaled businesses overwhelmingly disallow this, because they want that value for themselves.
And now we're much less reliant on oil, and more countries produce it and have reserves. The flip side is the economy and financial system already felt creaky anyway (tariffs, inflation, job market, government shutdowns, private credit, AI, etc.), so net net things may be just as bad or worse.
Steve Blank the startup whisperer and Steven Blank the economist are two very different people.
Because Delve defrauded them.
SPY is up at least as much as your Claude bot since the Nov 25 2024 start date, but you show it down 3%. If AI is both doing the trading and reporting the results, you...may have a problem.
Investors aren't on the hook for the bad behavior of companies they invest in. Quite the opposite: Defrauding investors (and acquirers, and creditors) is commonly the thing that lands people like Elizabeth Holmes in prison.
Reread the comment I replied to:
I would stare longingly into the void, wondering if I can ever work another python project after having experienced uv, ruff, and ty.
You think you're disagreeing with me, but you're agreeing. To wit: The original post is silly, because ty is beta quality and Ruff isn't stable yet either. Your words.
These are just tools, Pylint included. Use them, don't use then, make them your whole personality to the point that you feel compelled to defend them when someone on the Internet points out their flaws. Whatever churns your butter.
Ruff is performant but finds about half the issues Pylint does (see https://github.com/astral-sh/ruff/issues/970). Ty is quantitatively the worst of the well-known type checkers (see https://news.ycombinator.com/item?id=47398023). Uv is Astral's only winner.
Probably the handful of dashes (not even em dashes!) and the sentences "It was never just about the candy. It was about being together." Superficially these look like the AI markers people are always calling out, but only superficially.
The board of a Fortune 1000 financial services company just fired the CISO and Deputy CISO because they did too good a job cataloging all of the risk in their infrastructure. Now that it's documented and defensibly quantified, the company is somewhat obliged to do something about it, and the board was not thrilled.
It can be a rough gig.
This was more likely an Intune admin getting phished. Intune has a built-in wipe action: https://learn.microsoft.com/en-us/intune/intune-service/remo....
This is well known in cybersecurity circles. I mentioned here[1] a couple years back that I know CISOs who've had to clean up big messes because their predecessor was on the Cyberstarts payroll, but on the bright side I also know a couple of those predecessors who were fired for it.
Cyberstarts is the most blatant offender, but to be fair, VC has turned into the next rung on the career ladder for CIOs/CISOs, whose role is otherwise generally terminal (unlike e.g. COO or CMO). So a lot of deals get done now just on giving CISOs a path into VC. It's more subtle than Gili's way, and just as effective.
People point to the basic structure of "It's not X, it's Y" as the hallmark of AI, but I find it's more the incongruity between X and Y, especially when figures of speech (invariably strained) are involved[1]. That first quote reads like a real interaction that's been tightened up for print, but the second, the 'farm equipment' <> 'life-support system', does smell like AI, even though the article implies it's from an in-person conversation.
1. These are all from a single 850-word op-ed I saw the other day: "Presidents do not usually lose power because of a single speech. They lose power when a speech reveals something structural." "But the most important part of the speech was not the applause lines. It was the compression." "Markets can rise. But voters do not live inside charts. They live inside grocery stores and mortgage payments." "The issue is not whether a statistic was stretched. The issue is that the presidency becomes reactive instead of agenda-setting." "That friction is not theoretical — it is baked into the constitutional design." "Trump’s address was not a pivot to persuasion — it was a doubling down on confrontation as strategy." "They are not just another campaign cycle. They are leverage."
Happens all the time and doesn't mean anyone got screwed. A couple years ago Lacework sold to Fortinet for around $200m. That sounds like a nice exit for everyone, right? But this was after they'd raised $1.8b at a valuation north of $8b, which, ouch. When founders and employees fail this completely, yeah, their equity is going to zero.
Of course there are other cases where people do get genuinely screwed. My point is only that the cash value of an exit, even when it's a big number like $350m, doesn't tell you much.
Without liquidation preferences BrewDog wouldn't have been able to get the investment. They may have been able to get a loan instead, but the interest would've driven them under that much faster and then the creditor, just like the preferred investor, would have priority over other shareholders.
Which isn't to say preference stacks (like debt stacks) can't get absurd when a failing company is doing anything it can to stay alive, but standard investor terms (1x liquidation preference) simply mean you're first in line to get your money back if the company is liquidated for less than the price you paid.
The self-dealing bit is generally already illegal and orthogonal to liquidation preferences.
They are an alternative to 2FA. Which means they aren't 2FA. If they were 2FA, they wouldn't be an alternative to 2FA. They'd just be 2FA.
Anyway, passkeys and FIDO broadly aren't the same thing. You can read the definition of passkeys at https://fidoalliance.org/passkeys/ or look at any of the marketing, which invariably talks about how great it is that you don't have to futz with passwords anymore.
FIDO credentials in general can obviously also be used as second factors. This is baked into the name of the original standard: U2F, Universal 2nd Factor. The specific point of passkeys though is that they're the single factor.
That's not what two-factor means. Forget about passkeys -- if you use a password manager, and that password manager has a biometric lock, your accounts don't thereby have a biometric lock as a second factor. The transitive property doesn't apply here.
Passkeys are meant to replace passwords. Not being second factors is the point.
What you're describing isn't a pump and dump, but in any case what Jane Street did wasn't a pump and dump or what you're describing. It also had nothing to do with market making.
India's market trades options much, much more than the underlying stocks. This means that on one hand you can trade a lot of options without moving the market, and on the other you can move the market by trading comparatively few shares. Since options prices tend to be bounded by the price of the underlying, this is...a problem. For example you could buy shares to move the price up, sell calls, buy puts (aka a collar), then sell the shares to move the price back down so both calls and puts make money.
But it doesn't necessarily look like this is what Jane Street was doing. Instead they seem to have realized that stock and option prices already regularly diverged, and put the collars on to profit from corrections. In other words: arbitrage. Which, fair, can be functionally indistinguishable from market manipulation. But on paper it looks like they made prices better for everyday folks at the expense of the market makers and other institutions.
Matt Levine wrote a long Money Stuff column about this around the middle of last year.
This particular gift is also problematic because Horowitz is an investor in Flock, and Horowitz's family foundation is spending money on Flock that will in turn increase its value, which benefits him as an investor. Of course lawyers will have looked at all this to make sure it doesn't run afoul of self-dealing rules, but that just means the rules verge on uselessly weak.
It works because the original filter has suboptimal settings. An optimal filter of that size and number of items would set 5 bits per item and have about a quarter of the false positive rate. The 2 bits per item in the blocked filter is still suboptimal, but it's also saving them from saturating a bunch of 32-bit blocks, at the cost of a much higher overall false positive rate.
That struck me as an odd choice, too. On average there's no difference in false positives, but the smaller the blocks, the more likely they'll be saturated. Since there are 6 leftover bits in the hash anyway, there's no cost to increase the two 5-bit values to 6 bits and the block size to 64. You'll have a lot fewer hot blocks that way.
With blocks this small there's also no reason not to optimize the number of hash functions (albeit this brings back the specter of saturation). There are no cache misses to worry about; all positions can be checked with a single mask.