eddythompson80

Google's ad revenue from search is over $100B per year.

Google serves ads on search, maps, YouTube, android apps, amd all websites using Adsense or video ads

We were so close to having literal plain Linux phones.

IIRC, the dominant position back then was "Android is Linux". Shuttleworth closed his famous #1 bug on Canonical that was their mission in 2013 because now Android/Linux is more popular than Windows and the future is mobile[1]. Also Google still had a lot of good will in the OSS/Linux community back then so most "Mobile Linux" attempts were met with "Just use Android"

[1] https://www.omgubuntu.co.uk/2013/05/mark-shuttleworth-marks-...

It boggles the mind what AI is doing to some people’s brains. A few months ago we released various vibe-coded SDKs in few languages and a CLI for a rest API we had. Then an immediate ask after that was a dashboard that shows the usage of those various SDKs and CLI. I thought it would be straightforward to check the userAgent on all the API calls, but realized that all the user agents across all SDKs and CLI were the same. So I made a couple of simple PRs to all of them to have the language name in the user agents, and was composing a reply about how we only have data for the overall new SDKs/CLI usage but once these PRs are merged and released we will have the breakdown. Before I could send my reply, I got a reply from another fairly senior dude saying “Here is a dashboard for the usage” with fairly convincing and organic-looking usage pattern for all the SDKs and all sorts of breakdowns and charts etc.

I was confused, how did he figure it out? Is it somewhere I missed? I checked the query in the dashboard and it was this insane looking query that was correctly looking for the shared userAgent, but also doing a shit ton of odd functions and weird looking math. I asked the guy and he pointed me to the obligatory 1,400 line markdown file describing the “plan” and “approach”. In between all the raw LLM-isms and very sophisticated “weighted normalized distribution of language spread over time” sounding sentences, there was a sentence that said “Since we only have one userAgent for all tools, we use industry standard distribution of language popularity to approximate the usage, and apply some randomness to emulate an organic usage pattern”

So basically the AI just made up some numbers that look plausible (python 20%, JavaScript 30%, CLI 25%, etc) with some randomness thrown in “to look organic”, and the guy was like “that checks out”. When I pointed that these numbers are wrong because X, Y and Z, the person who asked for the data said “that’s ok, it’s a great start and gives me something to use for planning with other teams. Feel free to refine them if you want, but it’s good we have some numbers”. I’m planning my exit soon.

But they explicitly setup the permissions this way.

Which developmental indicators are you referring to? Almost all economical numbers mean nothing if the country is a dictatorship because the admin can straight up fabricate all of them. Administrations in democracies have to manipulate the numbers, introduce new ones, etc while dictatorships can just say "Nah, make that number 20% higher". You can look at the EGP exchange rate over the last 10 years and tell me if that chart looks organic to you.

I meant hosting such instance with the bare minimum privacy considerations. Otherwise you would have to be honest with them that you’ll have complete access to all their photos and make sure they understand it. People’s camera roll is often akin to their text history or email. It can contain plenty of personal and private things. Just because we’re friends, or even siblings, it doesn’t mean it’s free-for-all access to everything.

Agreed on the difficulty of implementing server side features though, especially all the things people expect from a Google Photos alternative.

Normally I either encrypt a non-boot drive (if the VPS provider offers such a thing) or use gocryptfs. It’s still a pain though when reboots happen, unless you also put your key there. Application layer encryption makes it easier.

E2EE means the keys are on your own computer (or device or brain etc). The “someone else’s” computer is just hosting encrypted blobs.

It would make hosting a "Family and/or friends" instance possible.

I do go back and forth on the accessibility tradeoffs of E2EE for average people though. In this scenario, lose or forget your key/password and you lose ALL of your photos which are very important to some people. Losing them is pretty catastrophic. Google Photos or iPhotos really gives people a sense of security about their photos.

ps: It would also make it easier to host cloud instances for Immich without encrypting the file system of a remote server/VPS. Especially when renting servers from small-time sellers, I'm always weary about how much I can really trust their employees access control. I know some level of trust is unavoidable with physical access, but how do they handle those disks during maintenance would also be relevant.

The strange thing is that we are at the mercy of 3 corps.

Wait until you discover TSMC, ASML, Carl Zeiss, Intel and AMD, or even Nvidia.

It's only confusing because of the terms the industry uses to describe it.

To achieve the task, i.e: a GitHub being able to update an AWS Lambda without storing a secret/key/certificate you minimally need:

1. A way for GitHub to sign a request before calling AWS with it.

2. A way for AWS to verify this request was signed with GitHub.

3. A way to tell AWS what actions a valid GitHub request is authorized to do.

#1 is very easy with a public/private key signature. For #2 OIDC standardizes this part. Every IdP publishes their public keys in a standardized way. For #3 AWS already has a full permissions/roles system, so it makes sense to use that for this. Then you can get a GitHub action to do anything an AWS account can.

To string 1, 2, and 3 together you end up with the confusing flow you described.

Well not Go's package manager, right? Go modules came out 2019, Swift 2015?

I wasn't arguing against Swift needing a default package manager, I agree with that. Just the examples you picked to compare with are odd in context. You could compare Swift to its contemporaries like Rust or Zig and come to the same conclusion.

I find your choice of examples (dotnet and go) baffling to me. Both enjoyed a very long life (8-10 years) past “1.0” before getting a standard package manager. The other examples, Java, python and JS are significantly older than Go (and even dotnet). Python and JS also had a significantly different intended use (scripting) than where they ended. Expectations of a language and its ecosystem changed. The compiler, linker, build system, package manager, LSP, linter, formatter, debugger, and plenty more are expected of any new language now.

Apple has something with Swift similar to what Google has with Go. The language has a lot of desirable features for server development very much like Go and Rust. Especially when compared to Java and C#.

It makes sense for them to build their services using Swift instead of something like Go and the Swift-on-server team has been doing a lot of work to get swift in a usable state on Linux. Having a thriving opensource (starting with a package index) makes a lot of sense to them for that.

My only problem with Swift is personal taste and experience. I tried it on linux few times (admittingly few years ago now) and generally I wasn't a fan. Go and Rust solve all the problems that Swift could have solved for me, so I didn't bother. But just like node got an entire class of developers into server side programming, Swift could be apples approach to get their iOS and MacOS developers a way to easily write server side code in swift as well

Never ever use Azure Cosmos DB. The entire point is to lock you in. This isn’t some paranoid shit either. We use azure a lot, and I have worked with many people designing systems on Azure. Always avoid cloud providers lock in services. That’s their bread and butter. They want you to use them. They want you using Azure Cosmos DB, Azure Event Hubs, Azure Apps, Azure DataLake, etc. Same with AWS. Don’t be naive. Use Azure VMs, Azure Postgres, Azure Redis. Those are fine. You’re just paying someone for the operational cost of a service, but you can migrate of. There is no migration from Cosmos or DataLake. They tell you you can abstract your code, but that never works. They know you will be locked in. That’s the entire business model. Also resist the temptation of the offers they’ll through at you to link those services with all their other crap. Don’t be naive.

Pure slopium. I love it

I agree that virtualization has seen great advances. Kata containers on k8s are almost (not quite 100%) drop in replacement. Regardless those last 10% remain a problem.

I run a personal server for few open source applications for personal use. I was thinking with all the supply chain attacks, and how carelessly I run `docker pull`s to update things I should probably consider hardening things a bit. I thought before jumping to full virtualization with Kata I can easily try gvisor/runsc first. Only to realize that DNS resolution is completely different with runsc vs runc and had to switch back.

Another sticking issue with virtualization is resource allocation. With namespace docker you can easily oversubscribe each container CPU/memory and rely on the single kernel letting individual containers burst as needed. With full virtualization this is still a big problem. Even with balloon devices and dynamic memory and CPU etc, the resource allocation is still not optimal. On a basic 8 core/16GB machine you can run 1 or 2 dozen services and things generally workout fine. Trying to run each of those in a virtualized VM you suddly can maybe run 6 or 7 maybe. There is no way to tell VM 3 kernel to drop its file system cache because VM 6 needs to load a large file in memory. Even if you script it out, now VM 3 is slow because it dropped all its cache while VM 6 finished processing 3 hours ago. These are not unsolvable problems, but despite how far virtualization has come, are still friction points.

Not to mention issues like sharing hardware devices (GPUs, disks, USB devices etc) between multiple VMs

Its the now-classic "Sorry I drowned little Timothy. Here is a breakdown of what happened" followed by "Let me try to respawn little Timothy on a new map"

Exactly. We have about 6 new repos for new green-field projects each with 700+ auto-generated issues so far. No one is looking at them, but we do have them tracked so "Mission Accomplished" GWB-style.

This might be as easy as a directive to populate a .md file.

It probably is. But do you really think anyone is gonna bother with the multiple daily (or hourly for green field projects) `+8,234/-3,734` PRs everyone is submitting?

The joke I was referring to is the common

     // ksmith (3/23/1997): This is a temporary hack for now. Find a better way to do this asap.

It would be cooler if the llm said something like:

I noticed the machine doesn't have copy-fail patched, here is a quick workaround for not having root access for now.

// TODO: find a better way to do this in the future.

I don't really know of any distro that doesn't do that. All of Docker Inc. default installs and all of distros I know of don't automatically add you to the docker group. docker.com instructions has the infamous "linux post-install instructions" that explain and walk you though it.

The tragedy is of course that when security and usability collide, 80/20 rule will apply where 80% of people will pick usability over security. I have worked with many with the title >= "Senior Engineers" who saw that page, read the explanation, and still had no idea what the ramifications of their changes were. "Yeah sure it said any user in the docker group will be able to get root on the host, but aren't containers isolated?"

Kotlin <-> Java interop is a totally optional topic you could have skipped over

This is the same place F# has been stuck in. It’s a great language on its own, but you can’t just use F#. Every F# must also do C# interop. It’s too 100% optional in theory, but never in practice. The best CLR/JVM libraries for anything are Java/C# ones. You need to interop with them to develop practical Kotlin/F# applications. You can limit yourself to the Kotlin/F# ones, but then you’re artificially limiting yourself to experimental libraries at best. You will find yourself needing a charting library, a DNS library, an SMTP library, an AWS SDK or a rabbitmq SDK. The best ones are gonna be Java/C#. Yes, you can always find a random GitHub repo for a “Kotlin-native X”, but the Java X library is a thousand times more mature, stable, performant, feature rich, etc. Same problem with F#. And the “glue” code is so “straight forward”, why would any one bother?

All these numbers are fake. They are all special cased in most ISPs with the cooperation of cloudflare, Netflix, OOkla, Akamai, Google, etc. The centralization of the internet around AWS, Azure, Google, Netflix, Cloudflare, etc has been a godsend to ISPs and the internet infrastructure in general. Maintaining good network conditions to 4 or 5 dozen networks and working with them closely is so so much easier than maintaining full peer-to-peer network conditions. Go ahead and try to test internet speed to your home network over a wireguard VPN and compare it to the performance of the same VPN when connecting to any of the major services. Try to setup a tunnel between your house and your friends house in the same city and test the speed and compare it to fast.com or cloudflare.com or speedtest.net

That’s a really over simplification of the issue. Plenty of Netflix edge CDNs are (and always were) ISP hosted. It’s a win-win for both and a complete no-brainer. The ISP v. Netflix argument was always about contract and margin negotiations. Flat rate, usage percentages, minimums, maximums, special plans, cuts, etc. who has the upper hand in the negotiation so to speak. Funnily enough the repeal of net neutrality gave those smaller ISPs much better position in the negotiation with big tech, not necessarily Comcast. The internet discord focused on Comcast and Verizon because fuck those guys. Who is gonna argue in favor of Comcast or Verizon? But the real winners were thousands of smaller regional ISPs.

It happened enough times that I'm suspicious the ISP had some way to detect if you run a speedtest, and then prioritized traffic to that customer.

ISPs definitely know when you run a speedtest.net test. 90% of the time, the data for that comes from boxes/services they host themselves. It’s not exactly hidden either. It’s a typical program any ISP can sign up for and you can easily see the destination the test is running against. I won’t be surprised if some have some logic to prioritize particular subscribers plan once they have detected a test from them. They probably view it as a “customer support calls reduction” feature.

Of course they are not complex. They do have a network effect though. If you go to your local ISP and say “hey, my 500mbps plan is only doing 100mbps on Speedtest.net”, they’ll “fix it” (usually by working with Ookla to put an edge endpoint on their network)

If you tell the “hey frankyspeeddetect.com isn’t doing my 500mbps” they’ll tell you to it’s an issue with that random website. ISPs and services reach out to Ookla to onboard with them because they have a network effect/mindshare of whatever you wanna call it

I don’t follow. It’s the other way around. Would you rather run an arbitrary binary blob (aka: a random cli) or `curl`?

Edit: Maybe to clarify, I’m talking about remote MCP. Local MCP is obviously nonsensical. Remote MCP is very much thriving aggressively.

Not a fan of MCPs for my personal use, but I still think the value for companies is obvious. The first value for their downstream (OpenAI, Anthropic, etc) is REST call vs arbitrary code execution. You only need to "trust" the MCP client implementation, not a thousand different CLIs. Also being a standard HTTP endpoint, a lot of logic can be offloaded to proxies and such.

The second value is more about how business works. There is no chance you can convince someone at WalMart to fund and release a `wmctl` that allows you to search and buy products. Now try to convince your regional Pizza chain to release a CLI too. WalMart and such are incentivized however to create "Whatever OpenAI and Anthropic integrate with". Shopify can create an MCP for every shop and allow the shop owner to customize it. Creating a CLI per shop makes no sense. OpenAI and Anthropic prefer MCPs because of the first benefit. So it works out for all parties involved.

False analogy isn’t a deflection, it’s a logical fallacy.