HN user

edanm

10,960 karma

Hello HN'ers!

Looking to get in touch? edanm@btlms.com.

I'm the Chief of Staff to the CTO at Irregular, a frontier AI Security company. We are working to prevent harm from AI models.

I was also previously a 2x entrepreneur of bootstrapped companies (professional services). I've been involved in many different fields in software.

Feel free to reach out about anything!

Posts44
Comments4,114
View on HN
www.irregular.com 26d ago

Assessing GPT-5.6 Sol Against Cybersecurity Benchmarks

edanm
1pts0
www.irregular.com 1mo ago

FrontierCyber: Bringing Offensive Cyber Evaluations to Real Systems

edanm
4pts0
www.irregular.com 5mo ago

Vibe Password Generation: LLM-Generated Passwords Are Dangerously Insecure

edanm
7pts3
www.irregular.com 7mo ago

Evaluating GPT-5.2 Thinking: Cryptographic Challenge Case Study

edanm
2pts0
www.seangoedecke.com 9mo ago

We are in the "gentleman scientist" era of AI research

edanm
5pts0
newsletter.hipposys.ai 1y ago

Show HN: Open-source project to autogenerate dbt documentation

edanm
2pts0
newsletter.hipposys.ai 1y ago

Show HN: Talk to your DAGs with Airflow MCP server

edanm
1pts0
newsletter.hipposys.ai 1y ago

PydanticAI vs. LangChain: A Tale of Two AI Frameworks

edanm
3pts0
newsletter.hipposys.ai 1y ago

Demystifying RAG: The Technique Powering Modern AI Products

edanm
1pts1
newsletter.hipposys.ai 1y ago

Airflow Plugin Tutorial – how we built the EDW Grants plugin

edanm
1pts0
newsletter.hipposys.ai 1y ago

Managing User Roles in Airflow with the EDW-Grants Plugin

edanm
1pts0
scottaaronson.blog 1y ago

Steven Rudich (1961-2024)

edanm
2pts0
www.algorithm.co.il 3y ago

AI Injection attack: OpenAI’s APIs are broken by design

edanm
2pts0
edition-m.cnn.com 7y ago

Stan Lee dead at 95

edanm
5pts0
www.solidangl.es 8y ago

A Radical New Look for Logarithms

edanm
2pts0
blog.purplebit.com 12y ago

Keep Your Single-page Application Codebase Separate

edanm
2pts0
mtgox-investigation.cc-int.eu 12y ago

Analyst successfully regains his $20K sent to Mt. Gox. Leads fraud investigation

edanm
3pts0
www.youtube.com 13y ago

Ridiculously Huge Numbers [VIDEO] (Series of YouTube videos)

edanm
1pts0
kotaku.com 14y ago

Most Popular Video Games Are Dumb. Can We Stop Apologizing for Them Now?

edanm
1pts0
news.ycombinator.com 14y ago

Ask HN: Software/Resources for Freelancers

edanm
5pts4
www.google.com 14y ago

Google Does a Barrel Roll

edanm
3pts1
techcrunch.com 15y ago

What Bill Gates Could Learn from Chris Rock

edanm
1pts1
blog.asmartbear.com 15y ago

Your startup gets $20k cash + 20 mentors this summer CapitalFactory 2011

edanm
31pts10
blog.asmartbear.com 15y ago

“Fantastic” beats “efficient”

edanm
43pts7
blog.asmartbear.com 15y ago

Marketing Platform Independence

edanm
13pts1
steveblank.com 15y ago

Creating Startup Success – Customer Development + Business Model Design

edanm
54pts10
www.codinghorror.com 15y ago

Breaking the Web's Cookie Jar

edanm
30pts6
wikimediafoundation.org 15y ago

An appeal from Wikipedia founder Jimmy Wales (asking for a donation)

edanm
2pts1
www.readwriteweb.com 15y ago

Facebook Email Coming Monday with Office Web Apps Integration

edanm
1pts1
www.loopycode.com 15y ago

Facebook is Killing Email

edanm
2pts5

On the other hand, if you already are a good/skilled programmer, AI is not solving anything for you. Its output is flawed and has to be manually fixed and refactored. When you consider the prompting and the waiting and the cajoling and the fixing and the refactoring, it's not really doing things faster than you could.

This seems to not coincide with the reality of some very skilled programmers saying exactly the opposite.

Just to quote the latest one, here's Linus Torvalds, who I think we can agree is a good programmer:

AI is a tool, just like other tools we use. And it's clearly a useful one.

It may not have been that "clearly" even just a year ago, but it's no longer in question today.

There are other questions around AI (like what the economy of it will actually look like in the end), but "is it useful" is no longer one of those questions. Anybody who doubts that clearly hasn't actually used it.

I don't get this perspective.

How much of the source code of the compiler you use did you read? How much of the source code of the standard library of your chosen language did you read? What about the dependencies?

How much of the source code of a huge codebase does the average developer read? I don't think any human alive has read the majority of code in huge codebases like Word, Windows, Linux, etc.

For almost every developer, the majority of the code you use every day, whether in software you use or actual code you're shipping, is not code you've ever read. And no one seems to have a problem with it, because we've built lots of processes around this. It's only when the code is written by an AI and not a coworker or random library author that people seem to have a problem.

And I get it! AI wasn't very good at writing code two years ago. Maybe even a year ago. I think it's good now, but maybe you don't - ok, that's fine, maybe it'll only live up to your standards in a year or two or ten. But that doesn't seem to be what people are arguing, it's not "AI isn't good enough", it's "how can we possibly ship code we never read", and my point is that we've all been doing this for our entire careers.

Show HN: 18 Words 13 days ago

First, this is fantastic! Really fun.

I really like everyone's idea of finding some way of letting the player play all 18 words. Either count up time, and use total time as the score (while allowing pausing). Or else just count the total score at the end, and if someone fails a word it's reduced from the score. So you got 16/18 word or something.

That's not ever going to be enjoyable. Tolerable, perhaps, given focus on the goal, but few people would be willing to tolerate it.

This is wrong in multiple ways.

For one thing, lots of people enjoy pain and discomfort caused by exercise. Some people even enjoy pain directly! There's ample evidence of this. You're painting with way too broad a brush given that there's enormous variance between people.

Secondly, there's clear evidence that many people do enjoy exercising, because gyms/parks/basketball courts/whateverl are often very busy. Are all these people just waiting for it to end? They're there voluntarily.

Not that I disagree with anything here, but...

I wish it were clearer in these kinds of posts how "I use AI code I don't understand" is so different from "I use libraries written by other people I don't understand", or "I work in a large codebase which was 99% written by other people, and I haven't seen all of it", or even "I use software written by other people I don't understand".

Yes. One point I don't usually see people address is that using external dependencies has much of the same properties.

Developers often depend on external libraries like things for Image processing, Numpy, etc. Do they have to "own" the code in those external libraries and review them, in the same way people sometimes insist you have to review all AI-generated code? Do developers have to be able to recreate Numpy by themselves, even if their field isn't necessarily numerical optimization etc?

Those seem like very high and unreasonable bars.

1D Chess 3 months ago

Yep, just lost after I think >5 years. But not because of your comment, because of GP comment.

Wiz joins Google 4 months ago

Despite commenting on this literally five seconds ago in the sibling comment, I hadn't made the connection that if "vav" is V, then using "vav vav" is like "VV" which is like "W". I wonder if this is a real thing.

In any case, I'm pretty sure it's just a coincidence, I don't think it's a stylistic thing, unless I'm missing something.

It's pronounced the same as in English. Wiz, Waze, Wix. It's written with "double vav" in Hebrew, not just a single vav which would make it read as Viz.

I should clarify — I disagree with disallowing any comments that used LLMs in the writing. I think comments should be judged on their quality, not on how they were written.

I might agree (don't know) with the idea of limiting new accounts more heavily.

I wasn't talking about someone learning the language and using this instead of learning it.

There are a lot of people who understand English fairly well, but are not actively learning the language, are not native speakers, and can use LLMs to catch grammar mistakes that they otherwise wouldn't notice. Or catch small nuances in what they are saying, small implications that could otherwise go unnoticed.

In general, I push back on people saying "I can't find a good/legitimate use for this technology, therefore there are no good/legitimate use for it".

I disagree with this policy.

Some people can really benefit from using LLMs to help them write. E.g. non-native speakers.

LLM-assisted-writing doesn't have to be low effort, it can help people express themselves better in many cases. I'd argue that someone who spent their time doing multiple passes with an LLM to get their phrasing just write, has taken obviously more care than the majority of people on HN take before commenting.

And if you don't like the way something is written? Just down vote it. That's true whether or not it's partially/wholly written by an LLM.

1. We're very bad at measuring developer productivity. We've been trying to do it for a long time, and really have very little to show from it from my POV.

2. That said, almost all the people who "want to see a study" don't make sense to me. I don't remember anyone insisting on seeing a study that shows that writing Python is more productive than C; people just used it and largely agreed that it was. How many studies show that git (or other DVCS) are better than the things that preceded it? I don't know if any exist. I do know that nobody was looking for studies before switching to git.

I don't ever remember seeing any new technology in software development for which people demanded studies before adopting it. They just assumed that if the professional developers they trusted to build their software said something was better, then it was — a correct assumption IMO.

Now, we're seeing a technology which most professional developers — that have used it seriously, at least — insist is orders of magnitude better than anything else that's come before it. And suddenly developers can't be trusted? Suddenly, when the claimed effect is orders of magnitude bigger than almost any other new technology, developers are biased and incapable of making this kind of determination?

I really don't think that's a serious position to hold.

Turing gave a pretty rigorous definition of the Turing Test IMO. Well, as rigorous as something that is inherently "anecdotal" can be, which is part of the philosophical point of the Turing Test.

Six Math Essentials 5 months ago

I'm a purely amateur mathematician and not a physicist at all, but I completely agree with you that maths is missing this "midway between pop-math and real-math-textbook" kind of book.

One book that I can't recommend more highly is William Dunham's "Journey Through Genius". He picks ten or so the greatest proofs in math over the centuries, then proceeds to give you all the historical background about why they were created, who created them, etc, and then proceeds to give the full details of the proofs themselves. Including showing places the proof is considered wrong by modern standards.

It's my favorite "semi-pop-math" book, I highly recommend it.

I never heard that. It didn’t seem like 3D-printing ever showed sings of displacing existing ways of manufacturing at scale, did it?

It absolutely was the "promise" the media spun.

I had the relatively unique experience of moving from being an outsider to this field to being an insider. While I was an outsider, my impressions, formed by the media, was exactly that—3d printing would be the next big revolution, in a few years there'd be a printer in every home, etc.

I then joined a company that allocated a lot of resources to 3d printing. It only took me a month or two to realize that the big media claims were absolutely ridiculous, and didn't make any sense as stated. They misunderstood the state of the technology, and misunderstood basic economics and how regular manufacturing works.

That's not to say there's no value in 3d printing or the maker movement. There's a ton of value that's been uncovered. But the specific media dream of "people will be printing their plates at home instead of buying them in the store" was never real.

(Btw, IMO "vibe coding" is absolutely real and revolutionary, likely the biggest revolution in the software industry since, idk, the invention of the computer itself. And AI more generally is, even beyond vibe coding aspect, a revolutionary technology that will change the world in many ways.)

I'm exactly the opposite. It'd been on my todo list for years to one day learn the difference between the different dashes. I kept putting not doing it.

Then came LLMs, and there was so much talk of them using em dashes. A few weeks ago, I finally decided it's time and learned the difference. (Which took all of 2 minutes, btw.) Now I love em dashes and am putting them everywhere I can! Even though most people now assume I'm using AI to write for me.

AI makes you boring 5 months ago

I agree with the sentiment in the first part of your post. But:

AI for actual prose writing, no question. Don't let a single word an LLM generates land in your document; even if you like it, kill it.

Why? What's the difference? I'm genuinely curious about your perspective on this. Lots of people can't articulate themselves well, especially if they don't natively speak the language they're writing in. I have my problems with LLM generated text, but you seem to be taking an extreme approach here.

self assessed developers productivity increases from LLMs are not a reliable indication of actual productivity increases.

I believe the other direction makes more sense; if the studies disagree with self-reported information, it's more likely the studies are wrong. At the very least, it's worth heavily questioning whether the studies are wrong.

This is based on research that happened at our company (Irregular), and I think it's very relevant to know about and to get the word out about this security issue.

Especially given the pervasive use of coding agents, who may without you knowing about it decide to generate a password for you, and it might seem secure but really not be.