dap

If your plan is to not review and just have the LLM rewrite if it doesn’t work, it doesn’t sound like the rewrite is gonna be any better.

It doesn’t have to be an intentional threat to be worth responding to. One might reasonably think they’d stumbled on an (admittedly poorly executed) attack.

Is it a taboo, or is it just reserving specific words to mean specific things and insist everybody be precise about it?

This is explicitly mentioned in the article:

Though some have questioned why anyone intending to blow up a plane would broadcast the word bomb, many terrorist acts have relied on the threat of a bomb as leverage during attempted hijackings or hostage situations.

This really depends on context. Sure, if you're responding to a forum post or StackOverflow question with nothing but the LLM output, then I agree with this. On the other hand, where I've done this at work, it's because I and some peers _together_ are trying to understand something (e.g., debugging), and Claude has some potentially useful input, but I'm not actually sure. And I'm looking to collaborate on interpreting the output together to see if there's anything useful. (Folks can decide to ignore it if it doesn't seem promising.) As another comment[1] said, pasting the output as-is contains other useful metadata.

There are also cases where I think I know the answer, and I ask the AI, and it produces a more complete answer than I would but I know enough to assess it. It seems like a waste of time to paraphrase the whole thing. That's the "Here's how Claude phrased it and I can attest that it's right" case.

[1] https://news.ycombinator.com/item?id=48243331

Have you not seen:

https://www.anthropic.com/research/project-vend-1 https://www.wsj.com/tech/ai/anthropic-claude-ai-vending-mach...

(Two different examples of a similar idea)

I don't think these things are as different as you think. I started at "ls" and worked down. If you work up, you get things like a "socket", an "object" within a programming language, a "linked list" in a standard library, an "HTTP client" within an application-level package. You can keep going up and rattle off lots of useful abstractions in application-level code.

There are certainly _bad_ abstractions that ought not to exist, which I think is what you're getting at. There are poorly built abstractions, and leaky abstractions. But abstraction itself isn't the problem -- abstraction is what allows us to build anything at all without being crushed by the sheer complexity.

I’m curious what you think an abstraction is. Even running “ls” involves several layers of abstraction: a shell, a process (abstracts memory), a thread (abstracts CPU)… you think it would be simpler if you had to deal with all that to list a directory (another abstraction)? Even bits are an abstraction over analog voltage levels.

Is the MET right? They launched about 29 hours ago but it says 1d18h

Thanks for the context. That makes a lot of sense! Those three constraints seem pretty important and a useful way to think about the problem.

Having used Rust professionally for six years now, I share your fear. Like many of the commenters below, coherence just hasn't been a big problem for me. Maybe there are problem spaces where it's particularly painful?

How does the Rust language team weigh the benefits of solving user problems with new language features against the resulting increased complexity? When I learned Rust, I found it to be quite complex, but I also got real value from most of the complexity. But it keeps growing and I'm not always sure people working on the language consider the real cost to new and existing users when the set of "things you have to know to be competent in the language" grows.

I've never once pulled in a new dependency and had the program fail to compile just by virtue of that dependency being present [because both my code and the new code both impl'd the same trait on the same type in some other code]. Because that can't happen because of coherence. (Right?)

It's so easy to forget about the problems we don't have because of the (good) choices people have made in the past.

I don’t think that sums up the post well. I would say:

The phrase “it turns out” has a surprising way of disarming skepticism in readers. While surprising, it’s easy to understand: the phrase suggests a story of the author’s journey of believing one thing, investigating, and finding something different. That’s more credible than simply saying the thing they now believe. The touch of vulnerability (admitting being wrong) avoids the reader’s ego getting defensive when asked to admit they were wrong. The net result is that it’s surprisingly easy to be convinced without any real argument.

I’ve noticed this as well (often in podcasts and programs like Radiolab) and I think it’s quite valuable to just be aware of it as a reader/listener, if you care about thinking critically about your own beliefs.

How long did humanity survive without vaccines for _everything_? Oh that's right.

Is this a trick question? Humanity survived by having enough people with enough other useful traits (like thinking, including the ability to reason about disease and how to prevent it) to overcome the numbers lost to disease. Humans died to disease in enormous numbers.

nor that they're all good for _me_ as an individual.

Herd immunity presents a real challenge to idea that people should generally be allowed to make their own choices. One's choice here affects everyone else, in a minuscule way that nonetheless adds up to many thousands of lives saved. I'm not sure what the answer is for this, but generally I come down on the side of: if a democratic process creates rules requiring us all to be immunized for the common good, that's okay with me.

There is important truth in your post, yet you seem to miss the really important pieces that make this hard.

It's the parents obligation to educate their child.

It's the child's obligation to use that education wisely.

Two obvious things complicate this:

- You weren't taught how to use a real gun at 6 months old, right?

- Would it not follow from what you said above that if you had accidentally shot and killed yourself at age 7, then it would be your own fault and nobody else's? That seems (to me, at least) like an absurd conclusion.

I think about it like this: as a parent, my jobs include identifying when my child is capable of learning about something new, providing the guidance they need to learn it (which is probably not all up front, but involves some supervision, since it's usually an iterative process), allowing them to make mistakes, accepting some acceptable risks of injury, and preventing catastrophe. I'll use cooking as an example. My kids got a "toddler knife" very young (basically a wooden wedge that's not very sharp). We showed them how to cut up avocados (already split) and other soft things. As they get older, we give them sharper knives and trickier tasks. We watch to see if they're understanding what we've told them. We give more guidance as needed. It's okay if they nick themselves along the way. But we haven't given them a sharpened chef's knife yet! And if they'd taken that toddler knife and repeatedly tried to jam it into their sibling's eye despite "educating" them several times, while I wouldn't regret having made the choice to see if they were ready, I would certainly conclude that they weren't yet ready. That's on me, not them.

You allude to this when you say:

I am very much for showing kids how to use the internet responsibly, but I'm not of the opinion that parental controls are particularly desirable beyond an initial learning period.

Yes, the goal should be to teach kids how to operate safely, not keep them from all the dangerous things. But I'd say that devices and the internet are more like "the kitchen". There are lots of different risks there and it's going to take many years to become competent (or even safe). Giving them an ordinary device would be like teaching my 2-year-old their first knife skills next to a hot stove in a restaurant kitchen with chefs flying around with sharp knives and hot pots. By contrast, without doing any particular child-proofing, our home kitchen is a much more controlled environment where I can decide which risks they're exposed to when. This allows me to supervise without watching every moment to see if they're about to stab themselves -- which also gives them the autonomy they need to really learn. The OP, like other parents, wants something similar from their device and the internet: to gradually expose elements of these things as the parents are able to usefully guide the children, all while avoiding catastrophe.

I inferred that they’re referring to the fact that in typical C the compiler must have seen a function earlier in the file for you to use it. One solution (that the author doesn’t like) is to put the leaf functions first so that they’re defined when the compiler sees their callers. The author seems to be ignoring the alternative approach: declaring functions at the top and then writing the in the top-down order that they like.

Doesn't this depend a lot on how long your actions run? Like, you may have already invested in your own hardware (maybe because your actions use a lot of resources and it's cheaper) and now you have to pay per-minute of action runtime for the API that does the bookkeeping?

> What remains is me feeling triggered when it feels like users' pain is being casually dismissed.

Was that done in this thread?

Well, I raised a general problem around 24/7/365 use cases (rooted in my operational experience, reinforced by the more-current words that I was replying to and the OP) and you called it "tedious", "low-info griping". Yes, that seems pretty dismissive.

(Is it fair? Though I thought the podcast episodes were fairly specific, they probably glossed over details. They weren't intended to be about those issues per se. I did write a pretty detailed post though: https://www.davepacheco.net/blog/2024/challenges-deploying-p... (Note the prominent caveat at the top about the experience being dated.))

You also wrote:

running an, at the time, outdated postgres, on an outdated OS

Yes, pointing to the fact that the software is old and the OS is unusual (it was never outdated; it was just not Linux) are common ways to quickly dismiss users' problems. If the problems had been fixed in newer versions, that'd be one thing. Many (if not all) of them hadn't been. But also: the reason we were running an old version was precisely that it was a 24/7/365 service and there was no way to update databases without downtime, especially replicated ones, nor a great way to mitigate risk (e.g., a mode for running the new software without updating the on-disk format so that you can go back if it's a disaster). This should be seen as a signal of the problem, not a reason to dismiss it (as I feel like you're doing here). As for the OS, I can only think of one major issue we hit that was OS-specific. (We did make a major misconfiguration related to the filesystem that certainly made many of our issues much worse.)

I get that it sucks to keep hearing about problems from years ago. All of this was on 9.2 - 9.6 -- certainly ancient today. When this comes up, I try to balance sharing my operational experience with the fact that it's dated by just explaining that it's dated. After all, all experience is dated. Readers can ignore it if they want, do some research, or folks in the PostgreSQL world can update me when specific things are no longer a problem. That's how I learned that the single-threaded WAL receiver had been updated, apparently in part because of our work: https://x.com/MengTangmu/status/1828665449850294518 (full thread: https://x.com/MengTangmu/status/1828665439234474350). I'll happily share these updates wherever I would otherwise share my gripes!

It is, although you can have sharded PostgreSQL, in which case I agree with your assessment that you want random PKs to distribute them.

It's workload-specific, too. If you want to list ranges of them by PK, then of course random isn't going to work. But then you've got competing tensions: listing a range wants the things you list to be on the same shard, but focusing a workload on one shard undermines horizontal scale. So you've got to decide what you care about (or do something more elaborate).

It's a question of resource margins.

What you describe is true and very important (more margin lets you weather more disruption), but it's not the whole story. The problem we had was queueing delays mainly due to I/O contention. The disks had the extra IOPS for the maintenance operation, but the resulting latency for all operations was higher. This meant overall throughput decreased when the maintenance was going on. The customer, finally accepting the problem, thought: "we'll just build enough extra shards to account for the degradation". But it just doesn't work like that. If the degradation is 30%, and you reduce the steady-state load on the database by 30%, that doesn't change the fact that when the maintenance is ongoing, even if the disks have the IOPS for the extra load, latency goes up. Throughput will still degrade. What they wanted was predictability but we just couldn't give that to them.

To be fair, I find oxides' continual low-info griping against postgres a bit tedious. There's plenty weaknesses in postgres, but criticizing postgres based on 10+ year old experiences of running an, at the time, outdated postgres, on an outdated OS is just ... not useful?

First, although I work at Oxide, please don't think I speak for Oxide. None of this happened at Oxide. It informed some of the choices we made at Oxide and we've talked about that publicly. I try to remember to include the caveat that this information is very dated (and I made that edit immediately after my initial comment above).

I admit that some of this has been hard for me personally to let go. These issues dominated my professional life for three very stressful years. For most of that time (and several years earlier), the community members we reached out to were very dismissive, saying either these weren't problems, or they were known problems and we were wrong for not avoiding them, etc. And we certainly did make mistakes! But many of those problems were later acknowledged by the community. And many have been improved -- which is great! What remains is me feeling triggered when it feels like users' pain is being casually dismissed.

I'm sorry I let my crankiness slip into the comment above. I try to leave out the emotional baggage. Nonetheless, I do feel like it's a problem that, intentionally or otherwise, a lot of the user base has absorbed the idea that it's okay for necessary database maintenance to significantly degrade performance because folks will have some downtime in which to run it.*

Every time Postgres advice says to “schedule [important maintenance] during low traffic period” (OP) or “outside business hours”, it reinforces my sense that it’s not suitable for performance-sensitive data path on a 24/7/365 service and I’m not sure it really aims to be. (To be fair, running it like that for several years and desperately trying to make it work also gave me that feeling. But I’m kind of aghast that necessary operational maintenance still carries these caveats.)

The exclusive lock is only needed during the final swap phase, and its duration can be configured.

FYI: even a very short operation that requires an exclusive lock can induce significant downtime if there’s anything else that holds a shared lock for extended periods. In [1], there was:

- a wraparound autovacuum (which holds a shared lock for potentially a long time — like hours)

- lots of data path operations wanting a shared lock

- one operation that should have been very brief that merely tried to take an exclusive lock

The result is that the presence of an operation wanting an exclusive lock blocked the data path for the duration of the autovacuum. Major outage.

[1] https://web.archive.org/web/20190320162510/https://www.joyen...

Edit: this was a while ago with v9.2, but I don’t know if any of this behavior has changed.

I’m sympathetic to looking down on the obsession with money. But there’s something deep and important about the monetary element. Engineering is about solving real-world, practical problems. The cost is a real factor in whether a potential solution is a useful one.

I think the money question is a red herring here. I’d phrase it more like: what problem in a user’s problem space is expressible only like this? And if the only user is the programmer, that’s alright, but feels more aligned with pure academia. That’s important, too! But has a much smaller audience than engineering at large.

You're right that you have to "write code well" to prevent this sort of thing. It's also true that Rust's language features, if you use them, can make this sort of mistake a compile-time error rather than something that only blows up at runtime under the wrong conditions. The problem with their last outage was that somebody explicitly opted out of the tool provided by the language. As you say, that's "not writing code well". But I think you're dismissing the value of the language feature in helping you write code well.

I guess you’re being facetious but for those who didn’t click through:

This type of code error is prevented by languages with strong type systems. In our replacement for this code in our new FL2 proxy, which is written in Rust, the error did not occur.

It seems obvious to me that "the ability to model, predict, and influence one’s future" is far more general and capable than "constrained to pattern recognition and prediction of text and symbols." How do you conclude that those are the same?

I do like that definition because it seems to capture what's different between LLMs and people even when they come up with the same answers. If you give a person a high school physics question about projectile motion, they'll use a mental model that's a combination of explicit physical principles and algebraic equations. They might talk to themselves or use human language to work through it, but one can point to a clear underlying model (principles, laws, and formulas) that are agnostic to the human language they're using to work through them.

I realize some people believe (and it could be) that ultimately it really is the same process. Either the LLM does have such a model encoded implicitly in all those numbers or human thought using those principles and formulas is the same kind of statistical walk that the LLM is doing. At the very least, that seems far from clear. This seems reflected in the results like the OP's.

Open-source ransomware?

I hear that, but it feels kind of empty because I haven't seen much discussion of that cost/benefit analysis (both of poisoning itself and of the change to the default behavior, which has its own costs and benefits).

I take it as uncontroversial that an important function of Mutexes is to ensure that invariants about data are maintained when the data is modified and that very bad things can happen when a program's data invariants are violated at runtime and the program doesn't notice. Maybe folks disagree about whether a program should always panic when invariants are violated at runtime (though there's certainly plenty of precedent in Rust itself for doing this, like with array bounds checking). Probably the bigger question mark is that panicking with a Mutex held doesn't necessarily mean an invariant is violated. But it does mean that the mechanism for ensuring the invariant has itself failed. I can see different choices about what to do here. For myself, the event itself is so rare and the impact of getting an invariant wrong so high that I absolutely do want to panic -- the false positive rate is just too small to matter.

This is a false dichotomy. Not every technique needs to work in all cases in order to be useful.

This seems analogous to arguing that because seat belts don't save the lives of all people involved in car crashes, and they're kind of annoying, then they shouldn't be factory-standard.

You seem to keep making the implicit assumption that because people are using `unwrap()`, they must not care about the poisoning behavior. I really don't understand where this assumption is coming from. I explicitly want to propagate panics from contexts that hold locks to contexts that take locks. The way to write that is `lock().unwrap()`. I get that some people might write `lock().unwrap()` not because they care about propagating panics, but because they don't care either way and it's easy. But why are you assuming that that's most people?