jbott

Complement AI (https://complement.ai) | Member of Technical Staff | San Francisco or New York City | ONSITE | Full-time | $150K - $300K + Equity

Complement builds AI that autonomously operates factories. We connect the fragmented systems inside a factory (ERP, MES, PLCs, spreadsheets, etc) into a unified data layer, then deploy AI agents that optimize decisions across the whole operation for profit.

As a Member of Technical Staff, you'll work across the stack connecting factory data sources, building simulations to optimize scheduling, embedding with factory operators, and designing interfaces that surface recommendations. We care about what you've shipped under ambiguity more than which of those you specialize in.

Apply: https://jobs.ashbyhq.com/complement/7d410785-31db-4aa4-85f6-...

Sensationalist title, the actual behavior described in the issue this links to is:

  Rust language doesn't offer lookaround regex features

1. https://github.com/fancy-regex/fancy-regex

This might be of interest to others: Last night I stumbled across Hornbeam, a library in a similar vein from the author of Gunicorn that handles WSGI / ASGI apps as well as a specific wrapper for ML inference

https://erlangforums.com/t/hornbeam-wsgi-asgi-server-for-run... https://github.com/benoitc/hornbeam

https://github.com/tailscale/tailscale-android

Updated URL is https://www.ubicloud.com/blog/hardware-touch-stronger-ssh

I think you misunderstand how mesh VPNs work. Their primary purpose is as a control plane - introducing peers to each other so they can either communicate directly or via a relay (eg DERP) via per-node encryption. They should have no overhead compared to a single point to point encrypted tunnel like wireguard, because the “mesh” features are not in the data path.

The only real difference here is how the vpn product implements wireguard: userspace or kernel space, and how well tuned that implementation is. It might make sense to compare wireguard implementations, but (afaik) all are using one of several open source ones. Tailscale did some work to improve performance that they blogged about here https://tailscale.com/blog/more-throughput

It looks like the host kernel is not in full control – there is a EL2-level hypervisor, pKVM [1] that is actually the highest-privilege domain. This is pretty similar to the Xen architecture [1] where the dom0 linux os in charge of managing the machine is running as a guest of the hypervisor.

1. https://source.android.com/docs/core/virtualization/architec... 2. https://wiki.xenproject.org/wiki/Xen_Project_Software_Overvi...

For those of us that don’t work at AWS, their docs are actually quite good at describing the Nitro system, very interesting read: https://docs.aws.amazon.com/whitepapers/latest/security-desi...

You might be interested in learning about Erlang – it supports hot code reloads natively: https://oozou.com/blog/understanding-elixir-otp-applications...

Erik also made "Wanderers" about this feeling, quoting Carl Sagan. Highly recommend watching it: https://erikwernquist.com/wanderers

TIL!

I don’t think the point about disk wear is true. ZFS is a block-based CoW filesystem already, so the “erase” is actually something more like “make a new metadata entry that points to an earlier state snapshot”. Plus, I’d expect normal disk usage (ie. chrome disk cache) probably far outweighs any disk wear you’d get from the (relatively) small size of files you get written into /.

Unless you’re working on a server with a ton of ram, I also think using tmpfs is more likely to shoot yourself in the foot with excess memory pressure. I don’t know of a way for the kernel to free memory if you write a huge file to the tmpfs partition by mistake, unless you use swap, and then you have the problems that come with that.

Tmpfs might be faster though!

This is linked in the footer of this page, but Graham Christensen has an excellent blog post “Erase your darlings” [1] that explains why you might want to do this. There is a script floating around on github [2] that does the install automatically, but I needs to be modified slightly to work on newer nixos versions. I have a forked version [3] that I used this morning, but my decisions might not make sense for everyone, but it’s provided as-is for now :)

1. https://grahamc.com/blog/erase-your-darlings/

2. https://gist.github.com/mx00s/ea2462a3fe6fdaa65692fe7ee824de...

3. https://gist.github.com/jbott/531b9d555dae7f197f25326ef251f1...

Unfortunately this syntax is not generally supported yet - it's only supported with the buildkit backend and only landed in the 1.3 "labs" release. It was moved to stable in early 2022 (see https://github.com/moby/buildkit/issues/2574), so that seems to be better, but I think may still require a syntax directive to enable.

Many other dockerfile build tools still don't support it, e.g. buildah (see https://github.com/containers/buildah/issues/3474)

Useful now if you have control over the environment your images are being built in, but I'm excited to the future where it's commonplace!

Yes, as far as I understand it breaks it, but combined with a package manager like Nix / Guix / Spack, this tool enables atomically upgrading dynamic library dependencies on a per-package basis rather than globally. If you want all applications to use a new version of a shared library, you'd need to re-"dynamic link" all of the reverse dependencies with this tool, but those package managers can handle that for automatically, and without needing access to the object files (unlike true static linking).

As I see it, that pattern is more of an alternative to container images, where this still gives you atomic dependency updates for an application without resorting to shipping N copies of each dynamic library.

How are these docs being built? I really like how these look and it looks to be asciidoc based, but I can't seem to find a build script for these.

Have you seen nx[1]? It looks like the first step towards this!

1. https://dashbit.co/blog/nx-numerical-elixir-is-now-publicly-...

I disagree that GUI tools like STM32CubeMX are useful. They end up being a crutch that end up adding increasingly complex wizard driven autogeneration, rather than just exposing the configuration in easy to consume ways. Sure, you can get something running fast, but it’s incredibly difficult to move from “blink a led via this template project” to “build a useful project integrating multiple peripherals”.

I think there’s some actually interesting work being done with standardization like SVD files, but too many vendors treat them like second class citizens compared to their bulky code gen solutions.

Dotfiles aren't enough to fully describe a system configuration, though. I'll regularly use both CentOS to Ubuntu, and both the available configuration tools and default services (along with other differences like SELinux vs AppArmor) trip me up more than I'd like to admit.

I think that’s missing the point he was making. No matter what front-end representation of a system you get, the implementation backing a no-code system will have edge cases around interactions both internally and with third-party systems. The fact that you’re hiding a system behind a veneer of “no code” doesn’t hide the fact that code is behind the actions that are taking place, it just means you can’t introspect it (even if this “no code” is in fact code).

I think a better point would be to make that that’s not a bad thing, sometimes abstractions provided in “no code” systems can greatly simplify a solution. But even the most well-designed solution will fail to some essential complexity of the root-problem the original authors didn’t understand. Without debugging tools (or privileged access to the backend of the implementing system) it’s difficult or impossible to understand what went wrong.

PPC 32 bit is still used extensively in the embedded space. It's understandable that it's not the main target for newer languages as LLVM support seems to be sparse (and practically non-existent for some dialects such as Freescale PPC-VLE) but it would be great to enable safer embedded development.

I̶ ̶t̶h̶i̶n̶k̶ ̶i̶t̶'̶s̶ ̶u̶n̶l̶i̶k̶e̶l̶y̶ ̶f̶l̶a̶s̶h̶ ̶r̶e̶a̶d̶o̶u̶t̶ ̶p̶r̶o̶t̶e̶c̶t̶i̶o̶n̶ ̶i̶s̶ ̶e̶v̶e̶n̶ ̶s̶e̶t̶ ̶f̶o̶r̶ ̶t̶h̶i̶s̶ ̶p̶r̶o̶d̶u̶c̶t̶,̶ ̶a̶s̶ ̶i̶t̶ ̶a̶p̶p̶e̶a̶r̶s̶ ̶t̶o̶ ̶b̶e̶ ̶p̶r̶o̶g̶r̶a̶m̶m̶e̶d̶ ̶u̶s̶i̶n̶g̶ ̶t̶h̶e̶ ̶d̶e̶f̶a̶u̶l̶t̶ ̶A̶r̶d̶u̶i̶n̶o̶ ̶I̶D̶E̶.̶ And even if not, most are trivially attackable with hardware access, for example the ESP32 secure boot stack: https://limitedresults.com/2019/09/pwn-the-esp32-secure-boot...

EDIT: Spoke too soon, claims Kinetis Flash Security is enabled (https://docs.crp.to/security.html#flashsecurity). This looks like it also disables JTAG access, so that is a plus ("8.3.2 Security Interactions with Debug", https://www.pjrc.com/teensy/K20P64M72SF1RM.pdf).

Other than that, this C code has a lot of smell - for example, the repeated use of the ptr variable looks like what something someone unfamiliar with the C type system would use: https://github.com/trustcrypto/OnlyKey-Firmware/blob/c71d207...

"Real time" in a mechanical system is pretty generous compared to electrical systems. Changes are in the timescale of 1 to 100 hz compared to the kHz (or even MHz) switching speeds of many electrical systems. Once you switch away from the large rotating mass of an engine (+ drivetrain), you get pretty much instantaneous torque response on an electric motor for free.

I'd say it's more interesting that they were able to figure out the delta between driver intent and physical response without adding any sensors. Having that much flexibility in the firmware of multiple control units (probably collaborating between several vendors) was likely a more complex challenge.

This is software running on a users' computer. They will always have the opportunity to modify their configuration (or patch the running software if needed). The argument that DoH is a step backwards doesn't make sense, since it's always been possible for software that wants to circumvent hosts file / DNS filters to use an alternate name resolver.

I agree that we should push for more configuration options, but the fact remains that it's the users decision to run software that doesn't respect their freedom of choice, and ultimately they control the code that runs on their machine.

DoH is overall a huge benefit to preventing in-flight tampering and protecting user privacy. The net-benefits far outweigh the downside that "good" network providers can no longer tamper with DNS results.

The bazel installation process has gotten a lot better lately - they now bundle OpenJDK inside the binary and it is only a single download.

You individually? There really isn't a reason to. *

However, as a whole, the lack of native IPv6 support in EC2 certainly held back the global deployment cycle. It's the chicken and the egg problem: Without support for servers that use IPv6, there is no reason for last mile providers to implement it in households. With this update, a huge swath of sites will get support, hopefully leading to quicker adoption for end users.

* for most applications. This is certainly trivializing a subset of applications where this could be useful.

https://en.wikipedia.org/wiki/Composite_overwrapped_pressure...

I've used Middleman in the past, but I actually just switched to Jekyll for my personal single page website.

I found Jekyll to work very well out of box. All of my content is in a markdown file, with styling broken out to layout HTML and CSS.

IMO, I find the community around Jekyll, along with the understandability of Ruby to outweigh using a simpler solution.

What does this consist of? Is it an open source project? I would love to set up something like this, but I constantly find myself not having the time.

Shouldn't the PCIe bus fix that problem?

I would assume the reason why usb converters do not work would be due to the fact that usb uses a host controlled polling system, resulting in discrete timing that can only be as precise as the bus speed.