HN user

michaelt

38,521 karma

Greetings from London, United Kingdom! I'm Michael.

http://www.mjt.me.uk

hn@mjt.me.uk

Posts15
Comments9,050
View on HN

Passkeys are primarily meant to replace passwords

Unfortunately, the designers of passkeys decided they should replace passwords and usernames and second factors.

Also they decided they should be cloud-synchronised, so the something-you-have second factor doesn't impose the burdensome requirement for you to have something, which was apparently a big usability problem.

SOC2 (Type 2) in theory requires an audit that you're actually doing what you said you'd do in (Type 1).

Even with an external audit - think of how many projects and repositories and servers and libraries and legacy systems Apple, a 50-year-old company with 166,000 employees, could have.

Then think about how much inspection is involved in a $50,000 audit. I doubt you get more than one inspector working full time for a year. In which case they've got 45 seconds of to audit each employee's entire work output. And places like EY will bill some people out at $700/hour, so it could be an order of magnitude less than that.

So this isn't some fine-toothed-comb forensic investigation or adversarial penetration test.

I'm logging into websites using unique passwords with 44 bits of entropy, which they feed into a hash algorithm that takes 200ms to hash each attempt, then entering a TOTP code or touching my Yubikey, and they check against my geoip history and fingerprint my browser and they want me to complete a captcha and they e-mail/SMS a one-time code to me and they send me an e-mail telling me there's a new login to my account.

The security industry loves to use belt and belt and braces and braces and braces. If they add an extra belt or two, I doubt anyone will remark on it at all.

Most standards for “high trust society” are astonishingly low.

Respect for private property rights? A court system that’s broadly seen as following the law? Elections where the outcomes are not disputed? Officials not soliciting or accepting bribes from normal citizens? High trust society.

The UK certainly has its problems, but the tricks are often technically legal, and they’re nowhere near as bad as in third world countries.

Power is only a small part, single digit, it will eventually matter but does not really today.

Sorta yes, sorta no.

A single 5090 consumes 450W - at Californian energy prices of $0.38 per kWh that's $0.17 per hour. And the card itself costs $4100 on amazon. So after 2.75 years running at full power 24/7 you'll have spent more on electricity than on the card. I would have thought most data centres being built today would have a design life longer than 3 years.

Of course you can throttle the cards to ~300W without losing too much performance. But also you need more than a single 24GB card to run most modern LLMs.

Luckily I've never sworn these things are real intelligences, I'm sure you're referring to someone else.

I consider LLMs more like the giant instruction book in Searle's Chinese Room. If you'd asked me 20 years ago I'd have said such an instruction book wasn't possible, as the nuances of things like sarcasm and irony were lost on even the most advanced the NLP systems of the day. But it turns out a book with 380GB of data can simulate human intelligence better than the average human can.

If you think of the washing machine and the dishwasher, I'd say humans are broadly OK with automating away some types of work they don't want to do.

Few people, though, would say my washing machine is a slave.

There is a huge cultural influence opportunity too.

Imagine if, in 10 years time, every school kid is learning the causes of the US civil war from an LLM, getting their essays on hiroshima and nagasaki graded by an LLM, and a million other things.

A country with competitive LLMs gets to decide whether "it was more complicated than just slavery", and whether "it was tragic but necessary, saving lives over all".

Countries without competitive LLMs are effectively going to be buying all their history, economics and sociology textbooks from abroad.

There are some fine products on the market compared to a few decades ago, yes. I particularly like the fact rechargeable lights are always at full brightness.

Alas when running in a group, the runner in front of you can not just obstruct your line of sight of the pavement, but also the light of your torch. His retroreflective vest becomes the brightest thing in your view. And he's not happy either; backlit by your torch, he casts a shadow forwards and the road ahead is illuminated everywhere except where he's about to step. And of course the tree-lined pavement, while very beautiful and shaded in the summer, isn't very wide. So you can't always run beside the guy.

My personal 'solution' is not to run fast enough to keep up with the guy ahead of me, giving me a clear view. But you don't win medals with my attitude.

I once lived in a city that had replaced street lights that cast light in a circle with modernised ones that cast a sharply delimited rectangle of light on the road, and didn't waste light in other directions.

The thing was, the roads of this city were arranged as a footpath, then a grassed area with trees, then the lights, then the roadway. Only after the city had rolled out thousands of these lights did someone notice the footpaths were now much darker. And also the footpaths were quite uneven, due to the trees' roots - a problem the lights had previously been keeping under control.

It's now common, in winter, to see groups jogging on the road.

The true extent of the damage has yet to be seen.

The Trump administration is a shot across the bows for Europeans, undoubtedly.

But do they have to up their defence spending a bit, engage in some tough talk, reduce their dependence on imported energy, and gift Trump some gold-plated furniture?

Or do they have to do that and eliminate their dependence on Boeing, Lockheed Martin, Northrop Grumman, Intel, AMD, nvidia, Apple, Mastercard, Visa, Google, Microsoft, AWS, Oracle, Facebook, Youtube, Netflix, Reddit, Twitter, Instagram, Juniper, Cisco, Qualcomm, Broadcom, Adobe and Uber?

Because the latter won't happen spontaneously, it'll need deliberate, decisive leadership. And Trump will be out of office long before it's done.

They're trying to show their investors a butler robot that can do all types of household chores.

Folding fabric has traditionally been very hard to solve with robots; the ideal places to grab the fabric might be hidden, the fabric patterns are repetitive, and the material flops around, tangles in the grippers, and brings other pieces of laundry with it.

Successfully sorting and folding a basket of laundry shows they've got a control system capable of performing some quite difficult tasks.

Video-processing AI can be very flexible in its demands.

Even if a camera supports 4k 60fps video, the 'edge AI' can downscale the input to 224x224 2fps and use a small network.

Often the 'edge AI' just needs to detect humans/cars/pets and trigger saving some footage to an SD card/turning on a light. It's not the end of the world if it misses some things or raises false alarms sometimes.

And if you buy a Reolink on Amazon expecting it to be able to recognise a face from 20 yards away, you'll be disappointed.

Qwen 3.8 3 days ago

Or it was prompted by the fact Xi Jinping was at the 'World AI Conference' launching a political alliance and saying things like “AI development should not be a solo performance by a single country, but a symphony of international cooperation” https://www.cnbc.com/2026/07/17/x-china-ai-summit-risks-secu...

Big conferences often come with a flurry of new releases and announcements.

According to the more detailed report [1] the questions and answers were:

Q2630. Do you currently consider yourself financially independent?

Yes: 72% No: 28%

Q2634. How financially independent do you currently feel from your parents (meaning you could support yourself without them if needed)?

Fully independent: 44% Mostly independent: 17% Somewhat dependent: 17% Fully dependent: 8% Not applicable: 14%

Then they report 17+17+8=42 = "42% of adults rely on their parents for financial support"

[1] https://news.northwesternmutual.com/download/2026+P%26P+Mark...

As I understand it, in America "it's just a tool" is shorthand for "guns should be regulated like hammers, i.e. barely at all, responsibility lies with the user not those who make, market and sell it"

Needless to say a lot of people disagree with that, because of the shootings. And internationally, a lot of societies regulate guns a great deal.

I'm not saying this to steer the conversation towards gun control, or to compare AI use to killing. Rather, I'm saying that the conversation here so far has has been confused because people have different ideas of what "it's just a tool" means, so they're talking at cross purposes.

To some it's an obvious statement of fact; almost everything man-made is a tool, AI is a tool like a pair of shoes or a guitar is a tool.

To others it's a statement that corporations should be held blameless, and access is a moral right that shoudn't be limited on consequentialist grounds.

I was in graduate school for robotics when CUDA came out, and the consumer card support was critical to nvidia getting to where they are today.

High Performance Computing option A wants to set up a call with someone with the authority to spend the best part of six figures, which could maybe be part of a funding application within a year or two, if there's a strong enough case for it.

High Performance Computing option B recommends you put in an application for time at the national centre that doles out access in 15 minute increments after you outline your entire project to them.

Then along comes nvidia, with CUDA - they want a one-off payment of $100, and on the day CUDA came out, almost every CS department already had a few dozen of the cards in computers they already owned.

No huge outlay, no ongoing spending commitment, no permission or application process.

I think it's less a question of batteries being economical, and more a question of the relative economics of batteries vs solar panels.

After all, if the highest demand is between 16:30 and 19:00 you could use batteries to store power at 12:00 and sell it at 18:00 - or in famously sunny Australia you could build enough solar panels that solar output at 18:00 matches power demand.

If batteries have a solid 9% return on investment, but solar panels have an even better 12% return on investment, panels will outpace batteries even though the batteries are a decent investment.

(Also, from a politican's perspective, making batteries highly economical is how you get batteries built. And an awful lot of pro-environment policies involve raising taxes, banning things and creating new chores; it's nice to have some green policy announcements that actually benefit voters in the short term.)

The behaviour of curl depends on how your version was built.

Python? The widely used 'requests' relies on 'certifi' and skips the OS store - but 'pip' on the other hand does use the OS store.

A tool that might use java, like a database or IDE, means it might have its own store.

Node? Make sure you set NODE_USE_SYSTEM_CA=1

Firefox and Chrome AFAIK both have their own stores.

Building a Docker container? That's intentionally isolated from the host, of course your container won't inherit the OS trusted CAs. Running a VM locally? Same.

Installed something using snap? The container-like isolation means it won't pick up the OS trusted CAs.

And of course you need the certs set up right on your cloud servers, your CI servers, the dozen different smartphones the mobile team uses for testing.

A lot of societies are set up to accommodate that society's dumbest members, and tourists, for most everyday tasks.

Outside of the workplace and my hobbies, I can't remember the last time someone asked me to read more than a few words, write anything at all, or do any maths more complicated than "the 12:20 train is 10 minutes late"

Personally I would say it's not respectful to a society to move there and not make a decent effort to learn the language - but I have no doubt a person could survive with only basic skills, if their workplace worked in their native language and they had an ethnic enclave as a support network.

Everything in business is a gamble.

Maybe tomorrow my competitor will aggressively cut prices. Maybe the product line I've spent money developing won't sell well. Maybe that new machine I've invested in won't be as productive as the marketing materials promised. Maybe bad weather will mean my customers stay home instead of visiting my shop. Maybe a war on the other side of the planet will raise my material costs and empty my customers' wallets. Maybe the artist headlining my music festival won't be allowed to enter the country. Maybe 10 years into its 50 year life my nuclear power plant will be undercut by falling costs for solar. Maybe Google will make the thing my app does a native feature of their OS. Maybe we pushed the envelope too far or didn't test thoroughly enough and we'll be buried in warranty claims.

This risk is why investments in businesses pay more than treasury bonds.

If you aren't comfortable with that, entrepreneurship might not be right for you - nothing wrong with being an employee and getting the certainty of a monthly salary.

The main case against regulation is that it shouldn't be used when competition would do it better, which is most of the time. The trouble in this case is that copyright is a government-granted monopoly, which means this isn't one of those times, because competition is being foreclosed by statute.

Microsoft may have a monopoly on Minecraft, but they still have competition from other games (Roblox, Fortnite) and other forms of entertainment (social media, youtube, books, IRL friends).

To me, the problem is more one of the terms of the deal changing; if a person brought minecraft with a 'mojang' account and loses their purchase when those accounts disappear in favour of 'microsoft' accounts, for example.

The reason bug reports feel like a ‘waste of everyone’s time’ is likely because you don't have the right error logging or telemetry built into the app itself. Having to wait for a manual bug report from a user is already a failure.

Yes and no.

You want enough logging and telemetry that you can roll out an update to 2% of users and know if something is terribly wrong before you roll it out to the other 98%.

On the other hand, you probably don't want enough telemetry to detect that customer Jim Smith has trouble with WebRTC when joining calls without a microphone while using Firefox and Cloudflare Warp with split tunnels enabled.

You have to accept that your pricing model sucks to a group of people (who are likely experiencing subscription fatigue) and decide if it’s worth losing or never getting their money.

And for some subscription situations, you can probably offer them a price that works for both of you.

There's a 'PhotoSync' app that offers a premium option for either $1/month or $24 for life. Presumably because they looked at the average subscription duration and found it was in the region of 2 years. Modulo the time value of money and per-transaction processing costs.

Personally I much preferred the one-off purchase, even though it's not clear I'll be using the app in 24 months, because it fits a lot better with my (somewhat chaotic) way of managing my money.