HN user

ThePhysicist

12,952 karma

Physicist, data scientist, programmer. Founder @ KIProtect

http://kiprotect.com https://github.com/adewes

Posts56
Comments1,787
View on HN
noyb.eu 1y ago

WhatsApp is getting ads using personal data from Instagram and Facebook

ThePhysicist
23pts2
news.ycombinator.com 1y ago

Ask HN: Is the River reverse proxy project doing well?

ThePhysicist
1pts0
news.ycombinator.com 1y ago

Ask HN: Small-cohort based "MOOC" like the original YC StartupSchool?

ThePhysicist
3pts0
news.ycombinator.com 1y ago

Anyone here running a domain registrar business?

ThePhysicist
3pts4
news.ycombinator.com 2y ago

Has making a passable 3D engine become easier or harder?

ThePhysicist
1pts2
news.ycombinator.com 2y ago

Ask HN: SMTP server for incoming mails, outgoing mails through big provider?

ThePhysicist
4pts1
news.ycombinator.com 2y ago

Ask HN: Online communities like the initial YC StartupSchool experience?

ThePhysicist
1pts0
news.ycombinator.com 2y ago

Ask HN: Fake Reviews on G2?

ThePhysicist
2pts0
news.ycombinator.com 3y ago

Ask HN: Software license that excludes using code for training ML models?

ThePhysicist
2pts1
news.ycombinator.com 3y ago

Ask HN: Small scripts, hacks and automations you're proud of?

ThePhysicist
332pts327
news.ycombinator.com 4y ago

Ask HN: Would you fund a world-wide-web without tracking?

ThePhysicist
15pts22
heykodex.com 5y ago

Show HN: Kodex – A Privacy-Focused ETL Tool

ThePhysicist
1pts0
news.ycombinator.com 5y ago

Ask HN: Global networking without vendor lock-in or MITM?

ThePhysicist
1pts2
news.ycombinator.com 5y ago

Ask HN: Event analytics without collecting personal data

ThePhysicist
1pts3
github.com 6y ago

Show HN: Open-Source Privacy Engineering Toolkit

ThePhysicist
2pts1
news.ycombinator.com 6y ago

Ask HN: Database for storing machine learning data?

ThePhysicist
3pts3
adewes.github.io 6y ago

Show HN: Epidemic Simulator

ThePhysicist
29pts15
news.ycombinator.com 6y ago

How to quantify the business value of machine learning?

ThePhysicist
5pts3
news.ycombinator.com 6y ago

Ask HN: Do you know what your ML systems are doing?

ThePhysicist
3pts1
www.wearesuperorganism.com 6y ago

Superorganism

ThePhysicist
1pts0
news.ycombinator.com 7y ago

Ask HN: How do you test your ML datasets?

ThePhysicist
2pts0
news.ycombinator.com 7y ago

Ask HN: How do you protect sensitive data?

ThePhysicist
26pts6
news.ycombinator.com 7y ago

Ask HN: Are there any good solutions for public audit logging?

ThePhysicist
3pts0
github.com 8y ago

Show HN: Have I Been Bloomed?

ThePhysicist
2pts0
klaro.kiprotect.com 8y ago

Show HN: Klaro – open-source consent management for websites (GDPR and ePrivacy)

ThePhysicist
24pts5
news.ycombinator.com 8y ago

Ask HN: Open-Source Portal on GDPR: What should we write about?

ThePhysicist
3pts0
news.ycombinator.com 8y ago

Ask HN: Your Data Security and Data Protection Challenges (GDRP-Related or Not)?

ThePhysicist
1pts0
news.ycombinator.com 8y ago

Ask HN: Is it weird to read articles written in English by non-native speakers?

ThePhysicist
16pts20
github.com 8y ago

Show HN: Command line utility and Go library to work with Bloom filters

ThePhysicist
1pts0
github.com 8y ago

ZFS-On-Linux encryption feature was just merged into master

ThePhysicist
3pts0

DigitalOcean simply does this at a later stage and will then just cut you off, Hetzner is doing it from the start. Their obligations aren't so different, they just approach this differently. It's the same thing with Stripe, it's cool that they just let you sign up and process transactions but at some point they will look at your business and if they don't like it they will just cut you off.

Also Hetzner really doesn't care much about individuals as far as I know, they mostly do business with other businesses and that's where the money is, their business is not designed to handle millions of individual users, DigitalOcean might also simply have a different strategy there.

Takes me back to when I was working on Josephson junctions (JJ) as a student, I-V curves were the first thing we did when characterizing a junction. JJ I-V curves were tricky due to the hysteresis they have in the underdamped regime, so we had some pretty involved stepping logic to ensure we get the curve with the required precision.

That said today everything is pretty much digital, you have Acqiris/Agilent 1 GHz ADCs and all the measurements are done in software, but I still remember using my old 20 MHz HMAG oscilloscope in XY mode with a triangle voltage generator to plot IV curves in real-time. Good old times!

Congrats Sonali, Nick, Dave & everyone else! I had an incredible time with you all in NY more than 10 years ago, it was so cool, and I'm still thinking of it very fondly. Spent my days hacking away in the space near Canal Street and the nights and weekends exploring NYC with other Recursers, visiting museums, parks and venturing out to buy cheap dumplings by the dozen. I was quite poor back then but I enjoyed my life so much, had a tiny room at the Kolping house on the Upper East Side which was very run down and tiny but also very cheap, basically just went there for sleeping and spent every other minute in the space and outside. No distractions, no possessions beyond my laptop, no responsibilities, simple but happy times. And then in 2021 I found my dream job at DuckDuckGo through RC, been working there for almost five years now! Thanks for everything and great to see it's still going strong!

Interesting that on one hand the valuation of these AI providers is based on the assumption that all code (and everything else producing digital artefacts) will be written using AI in the near future, on the other hand almost all popular open source projects fight to keep AI contributions out. Hard to reconcile.

Personally I'm also experiencing a bit of AI hangover after using it a lot in my own open-source projects. I find it's a bit like taking drugs (not that I have much experience with that) in the sense that in the moment I'm using these tools I feel great and powerful, writing features in a span of hours that would've taken me weeks to write by hand. But inevitably some time later I will look at the code and notice all the subtle cracks and inconsistencies the tool introduced, and despair a bit at the mess.

I now plan to use these tools less for extensive feature development and more for planning, debugging and narrow refactoring where I can put very strict guardrails on them. I'd still say it accelerates my work but not by a factor of 10, more like 1.5-3 (which is still a lot) given the care you need to ensure what is being built is actually good. For what I really like these tools is that I need less mental focus to do coding, but on the other hand I have this new kind of fatigue of being in a constant chat loop with a machine and trying to get it to do stuff based on natural language, never knowing how it will interpret what I write and wrote before. In that sense, these tools don't feel satisfying, it's like operating a machine where you try to push some buttons to get it to do something but the internal wiring changes all the time so you never know exactly what a given button combination will do and you have to figure it out by watching the machine and constantly adapting.

Corporations will be quite happy with really simple features if they're packaged right. I'm selling software that mostly does things that a good programmer could whip up in a couple of days or weeks, but what cost me most of the development time wasn't the features but all the FUD around them e.g. SSO, multitenancy, audit logs, corporate design support, ... Most enterprise software could be replaced with simple scripts and command line tools if they had this enterprise layer. I'd wager tons of SaaS is just simple open-source software and libraries behind a management layer.

It's quite easy to write a generic Maybe struct that performs most of the encapsulation that Rust's Maybe does i.e. allow unwrapping of the inner type through a function or handling the nil case through a switch like statement. I've never seen this in the wild which makes me think people don't care about it too much. And of course it's runtime based so no compile time guarantees, and just to preempt the expected replies I know it's not the same what Rust is capable off and Rust is of course a much much much much better language than Go.

Personally I do experiment with these things as it makes code more readable, it just seems adoption for generics and what you can do with them is still quite low in the broader community. That said I do not deal with null pointer exceptions much at all, and when I do it's often relatively simply to spot and fix, so for me it's not a large issue.

I think for mostly search-focused use case like the one presented here AI is great as you don't ask it to build stuff or invent new drugs, you just want to retrieve relevant documents with laser precision, and agents can do that.

I think right now I'm mostly disappointed with agents writing code as they always degrade the quality of the codebase after a while, and the same goes for writing in general which just requires a ton of editing and mostly just sounds good but doesn't have a lot of substance in the end. I think you can really tell that these systems are trained to just produce plausible streams of text, especially in longer artefacts you notice that locally the inner consistency of what they produce is great but globally it really falls apart, it's like seeing the limits of their "intelligence".

For search however I really like AI, it has improved information retrieval so much for me where before I had to think about which keywords to use and combine and which filters to apply, describing what I'm looking for in plain text and then having the AI find it for me feels magical. Recently I wanted to find an artist that I heard in some old episode of the KEXP runcast (a running podcast), and I didn't remember anything except that it was rap with a kind of monotone voice a fast beat and a strong accent. Googles' agent asked a few clarifying questions and after a few rounds it found the artist for me, Genesis Uwusu. That's why I think Google will win in the AI assisted search market, they just have the best integration between fast and reasonably "smart" agents and high quality search data. Claude or ChatGPT are too slow and don't have fast enough data retrieval it seems, using them for search feels quite sluggish in comparison.

Apple RAM prices always had quite a bit of margin though, I think they charged around 4x the going market rate per GB (that said you can't fully compare their RAM to a loose DIMM stick). I was planning to pick up a new Mac Studio this autumn, now I'll have to see if I can afford it, though I have been spending 1,000 USD on LLM subscriptions in some months so I guess even a 10,000 USD Studio Mac amortizes quite fast if it allows me to run coding models locally.

Everyone always wants to charge as much as they possibly can, and if SK Hynix would be the only manufacturer prices would be 10x of what they are today. Especially new incumbents will not ruin the market prices as they have the highest upfront cost and their calculation of entering the market is probably based on the high prices that can be achieved. In the long run, more competition is still good as everyone ramps up production to profit more from the high prices and at some point supply will outpace demand and prices will fall (assuming no cartel / price fixing is involved).

It's the ultimate power user desktop system, in my opinion it even dwarfs MacOS in terms of how you can customize it and how it looks. It left Windows in the dust a long time ago in terms of functionality and usability (not that this would be particularly hard given how Windows has been degrading over the last decade). Everything is super snappy, smooth, built-in apps like Konsole and Dolphin are super polished, Konsole runs circles around the MacOS terminal app.

Of course running Linux on modern hardware is still a bit fraught with errors, though it has been getting much better. I run a current gen Thinkpad X9 Aura and apart from the webcam which has fundamental driver issues on all Linux kernels everything runs really well, power efficiency is also great at around 10W, not as good as a MacBook (which I also use daily) but close enough for me, and I still prefer Linux over MacOS any day.

Are you sure about that? You are saying that differentially private census data couldn't be used for gerrymeandering and advertisement while non differentially private data could? Hard to believe, I'm not an advertisement or gerrymeandering expert but I would assume people running ads or cutting up districts are mostly interested in aggregate statistics i.e. they won't care about single households? And I would assume they can rely on voter files, party databases etc... And to the contrary there are reports [1] that indicate differential privacy actually makes gerrymeandering analysis more difficult or impossible. So, not really an argument for differential privacy, discriminatory action can be equally well taken based on differentially private data as the government cares about groups not individuals and groups aren't protected by differential privacy. It seems people really fundamentally misunderstand what this technique can achieve and what it won't do.

1: https://pmc.ncbi.nlm.nih.gov/articles/PMC8494446/?utm_source...

No, there are dozens of articles discussing the mechanism and explaining the impact it had in different areas e.g. [1,2,3]. And the release mechanism wasn't just "add noise", far from it, you may read the original paper [4] to see how intricate it was, anyone wanting to make real use the resulting data would have needed to understand that approach in detail to work with the resulting data. The report of the national academies [3] is probably the most comprehensive analysis of the mechanism and the complications it introduced, so writing "it has always been inherently inaccurate" is just wrong, this new mechanism was way worse than just introducing unbiased sampling noise.

1: https://www.aeaweb.org/articles?id=10.1257%2Fpandp.20191107&... 2: https://www.science.org/doi/10.1126/sciadv.abk3283?utm_sourc... 3: https://www.nationalacademies.org/read/27150/chapter/14

4: https://hdsr.mitpress.mit.edu/pub/7evz361i/release/2

I think it should be noted that there was a lot of dissatisfaction from users of the census data as far as I know. So it's not been banned just for politicals sake or because they hate privacy... Some people I talked to in the privacy field even called the whole thing a total disaster and weren't shy to put blame on John Abowd who apparently pushed this through despite a lot of internal opposition and concerns. Not sure if that's true, but what is definitely true is that the way the data was released produced serious issues downstream as most researchers and statisticians that ingested the data weren't prepared for receiving noisy data values. Differential privacy was applied in a way such that many invariants that data users cared about weren't preserved, which was expected as it's not possible as you can't preserve all invariants and at the same time add meaningful noise to the data. The thing is, with such a differentially private data release you need to adapt all of the downstream analyses to take into account the exact mechanism the data was altered in. And since the census bureau used a very intricate mechanism that didn't just add Laplace noise to data values but instead relied on a multi-stage process that preserved some invariants but not others it was very difficult to even write routines to account for the changes being made to the data. They essentially asked of every data user to rewrite their whole analysis pipeline based on the exact disclosure mechanism that contained a large number of bespoke choices regarding which data invariants to preserve and basically produced a mix of noisy, synthesized data that was just really hard to reason about. I don't even know if there even would've been a way to do this better, but the fact is that not every small county or school district has top-tier statisticians at hand that can just read a whole monograph on differentially private synthesized census data and then hotpatch their existing analysis systems to work with that data.

I was a big fan of differential privacy but now I think it might be doing more harm than good, as I haven't seen a single case where it was applied successfully in a problem where it actually mattered, and it contributed strongly to discrediting and preventing a lot of work on other anonymization techniques as it was deemed the only way to preserve privacy by the research community, so showing up with enhancements to k-anonymity or any other noise mechanism not rooted in it was a sure way to get ridiculed and ignored. And it's just not a practical mechanism, even when it works for a single disclosure you always end up having to blow up the privacy budget to a ridiculous amount in order to keep disclosing statistics as otherwise you would for almost all real-world data run out of budget after a few publications.

So, for me it's a technique that works in the areas where it doesn't really matter (publishing highly aggregated statistics that pose almost zero privacy risk even without differential privacy) and doesn't work in other areas where it would actually matter (publishing fine-grained data about individuals or small groups). There are some niche use cases but in my view the privacy community has really overblown the importance of differential privacy by portraying it as the only way to reliably anonymize data.

BTW the German census bureau has an interesting approach to anonymization which they use for several decades already and so far I haven't heard of any cases of successful de-anonymization of the data, maybe the US bureau should have a look at that for their own needs.

Notes on DeepSeek 1 month ago

Yeah Fable 5 is good but feels incremental and overhyped, also burned through my entire Cursor allowance in my Ultra plan in a single day. Ridiculous. They just want to create FOMO and appear mysterious so companies and users will feel so special for being allowed to use this model and pony up more money. After all they have to grow a few order of magnitude to pump their IPO valuation as much as possible, so I think this is just a strategy to justify their increased token pricing which starts to become absolutely insane. 10-20k per month per developer, do companies really think that's a good way to spend their IT budget? I assume 99 % of software shops wrtite run-of-the-mill web/mobile/desktop apps or some legacy backend APIs and CRUD code, you don't need a superintelligence to crank that stuff out. It sounds so ridiculous to have a model that supposedly can design biological weapons and then 99 % of users vibe code spaghetti Javascript with it. But the spice must flow!

Claude Fable 5 1 month ago

Well you can just scale your AI employees up and down as much as you want. Companies already pay a large premium for freelancers just to be able to fire them on a whim, so spending 5-10k a month on something that more than doubles the productivity of a senior developer might be well worth it as you can just adapt spending based on your business needs. If you can deliver a feature that lets you write a 100k invoice with 10-20k of tokens within a month or have a senior dev crunch that out in 6 months instead I think it's clear who wins. It's all about money and the AI companies know that, they have their pricing down exactly to sit in the sweetspot where it hurts just enough that companies can still afford it but not enough that they would look for cheaper alternatives.

I mean even cheap keycaps won't wear out for many years for most people, so I don't think quality is a big factor. I got tons of keycaps from Ali Express which are just as good as the high quality stuff, in fact most of them are made on thre same machines...

So not sure if that was really the issue, people ordered keycaps because they liked the design, e.g. the Dasher MT3 set was super popular due to a similar one being used in the "Severance" show.

Yeah I mean we have a mechanism that can bypass AI models for log lines where we are pretty sure no PII is in there (kind of like smart caching using fuzzy template matching to identify things that we have seen before many times, as logs tend to contain the same stuff over and over with tiny variations e.g. different timestamps), so we only need to pass the lines where we cannot be sure there's nothing to the AI for inspection. And we can of course parallelize. Currently we use a homebrew CFR model with lots of tweaks and it's quite good but an LLM would of course be much better still and capture a lof of cases that would evade the simpler model.

This is really cool! I am trying to find a way to accelerate LLM inference for PII detection purposes, where speed is really necessary as we want to process millions of log lines per minute, I am wondering how fast we could get e.g. llama 3.1 to run on a conventional NVIDIA card? 10k tokens per second would be fantastic but even at 1k this would be very useful.

People with such strong beliefs can be unpleasant to work with as well. Not saying you are, but there are often considerations beyond the immediate needs of developers that dictate tool choice in a company, and I find it not great if people complain about such minor inconveniences all the time (it's ok to discuss to some degree, but not in an overzealous way). Same goes for tech stacks, frameworks etc., I avoid hiring people that express extremely strong views (e.g. "JS is utter garbage") as they tend to be difficult to work with since they drag the team down with endless tech stack discussions and make others feel bad/inferior.

Sorry that this happened to you, if it's brand new or under guarantee I would just send it back. People always complain about Amazon but I buy most of my stuff there because they have always resolved such issues in my favor, even sending replacements or taking back hardware after the return period was expired.

These companies aren't public utilities, no one would complain about a US bank not doing money exchange business with entities in the Ukraine or Belarus, why would that be different for US companies offering donations over the Internet? The fact is that all platforms that facilitate cross-border money transfers between two parties without clear services or good being exchanged are used for all kinds of money laundering, and governments try to contain that for good reasons. In the end they probably don't care much about the revenue they make in these countries as it's probably negligible. Again, their good right to do so, I don't see any issue with this at all.

Domain hoarding is really annoying. Recently I noticed superposition.de was available and wanted to register it for a side business, now a domain grabber got it and is reselling it for 27.000 USD... I can't fathom how this is a legal practice. I mean, I get that it is legal but the naming authorities could change their terms of service to disallow such trading. It's a small annoyance of course but I find it tiring how every little aspect that made the Internet great is getting monetized into oblivion.

I've seen this so many times already, going from server-rendered web apps to client-side rendered web apps in React, then through multiple generations of state management and component management strategies in React, then back to server-side rendered stuff with Next.js, it is so tiring.

Probably needs to be taken with a large grain of salt and might be exaggerated but I recently heard a claim (https://www.youtube.com/watch?v=iKdtyDnGM-o) that the FHA program basically prevents a large number of foreclosures from happening as the government effectively keeps paying for loans where borrowers are already in default, and without the program many homes would be on the market again suppressing prices. If my understanding is correct the home owners get the interest payments made by the government tacked onto their mortgage so once they would go into default they would be faced with a home that is not worth enough to pay off the mortgage due to previously inflated market prices and all the added interest payments. Not sure if we have a new subprime crisis in the making here, it seems unhealthy in any case. But then again, never believe stuff influencers tell you on Youtube, so I take it with a healthy dose of skepticism.

I guess. I mean my own services get fake reviews without my involvement. I have a B2B software business for which I know all customers personally and still there is a product page on G2 reviews (which I didn't create) full of fake reviews, and I haven't been able to take them down (though I haven't tried too hard to be honest). I don't know what's the deal with that, I guess it's just about warming up fake reviewer accounts by writing reviews for products where it's unlikely that they will get flagged. They are all glowing reviews too, which I guess makes sense as writing a bad review would surely prompt a response from the affected company.