HN user

nahsra

89 karma

cto, pixee.ai (pixeebot on github)

ex-chief scientist, contrast security

security dork

Posts3
Comments27
View on HN

I understand this instinct, but I can see the appeal of capabilities that are well within the limits of a well-designed agentic system.

Imagine asking such a system, "look at my postprandial response to dosing for the past week and make ratio suggestions for breakfast, lunch, and dinner." This is genuinely helpful, saves time, and well within the reasoning limits. You could spot check if you like.

Is it worth setting up such an assistant for the value you'd get out of it? I guess that's on the user and how many similar use cases exist.

Yes, but it's held up really well in my opinion! I use this piece constantly as a reference and I don't feel it's aged. It reframed Anthropic as "the practical partner" in the development of AI tools.

Gene editing is still pretty crude in terms of delivery.

Just because you can hit some germ-line cells in the liver, for example, doesn’t imply you’ll have good penetration into the reproductive organs.

We can’t zap people and change all their DNA at once, unless we can intervene at the point it’s just a few cells.

Grit looks cool! My apologies for the omission, I was unaware of it. I could have anchored too hard to the word "codemod" in my searches. Your tool looks awesome!

Do you have an example of how you inject context into the codemods?

When you say "context", I want to make sure we're talking about the same thing, and the question makes me think we're not there yet. We're basically saying that storytelling about the changes is very important, so we bake invariance into the APIs of codemods themselves, so codemod authors are forced to provide descriptions, reasons, justification -- whatever -- at the key points.

This was certainly true in the past from my understanding of the history before my time.

Most terms are pretty standard now. And most of them have good reasons for existing — usually to align the founders and investors. Just because a term is complex and could benefit the investor doesn’t mean it’s meant to mislead.

But, I’m interested in some examples that might shake my opinion about up!

[dead] 2 years ago

So many common, important problems (and soul-draining toil) can be resolved with codemods -- this piece (which I authored) tries to explain how and why. I am eager for feedback from HN!

Utilize Automated Tools for Code Style [...]: Ideally, comments related to code convention or commit message convention should not be necessary. These aspects should be checked and corrected via automated tools and made a prerequisite before creating a PR. Let these tools handle consistency, freeing up valuable human review time for more substantive concerns.

This is hugely important. Decide on linters, static analysis, refactoring tools, etc., and after a deliberate selection process, never argue about them or their results again. Just make the tools happy and move on.

I've also seen high functioning teams choose and agree on an API design philosophy. Arguing about design with no boundaries the discussion feels like arguing about the entire open ocean. Limiting the universe to a small set of design inspiration (kind of like a standard set of UI components) prevents lots of discussion that doesn't help the team or the business.

For as many things as possible, we should be able to point to something outside of the team, and chosen by the team, and say "this is how we've chosen to do it and we're not going to fight about it."

Yes, "discovered" was too way strong of a word there, and apologies to Charpentier. Thanks for the correction.

However, she did win the Nobel prize and I have found source after source that suggests she seemed to be fundamental to the development of the science.

My point remains -- you could literally substitute her name with one of a thousand names associated with high profile biomedical miracles to have originated from prestigious universities.

Jennifer Doudna [1], who helped characterize* CRISPR, worked at Yale:

Doudna joined Yale's Department of Molecular Biophysics and Biochemistry as an assistant professor in 1994.

... and now works at UC Berkeley.

David Liu [2], who pioneered base editing, a generational improvement on classic CRISPR, works at Broad Institute (which is a collab between Harvard and MIT):

He is the Richard Merkin Professor, Director of the Merkin Institute of Transformative Technologies in Healthcare, and Vice-Chair of the Faculty at the Broad Institute of Harvard and MIT

I absolutely loathe the current social meta where people are allowed (even celebrated) for thoughtlessly punching upwards, regardless how broad the brush (boxing glove?) seems to be. Are there shitheads in these institutions? Undoubtedly. Are there also a ton of really brilliant people who have good intentions, have integrity, and deserve your utmost respect? Undoubtedly. Are the shitheads more likely to be located in administration? My bet is yes, because the scope of administration is a lot more political, but again -- we have to be careful.

Is it anywhere near accurate to say "They’re all wrought with dishonesty and self preservation"? I don't see how this statement could be supported with anything other than personal emotion. Anti-intellectualism is just another form of dangerous prejudice and should be treated as such. You can sign me up for metaphorically stringing up this particular asshole.

I also say all this as someone who didn't go to a prestigious school.

Happy New Years!

[1] https://en.wikipedia.org/wiki/Jennifer_Doudna [2] https://en.wikipedia.org/wiki/David_R._Liu

I don't have any problem getting it to help with exploit development. I never had any issue with that with any of them, in fact, which is surprising in retrospect.

Inference is so slow, and almost everything about fuzzers are meant to be super fast. Maybe there's a late stage part in crash validation/analysis where you can use it but my bias is that we're just not there yet.

My experience is they're not good at this for most vulnerability classes, especially the those that are tough to discover by classical methods. Have you had any experience using them for this?

Trivial vulnerabilities are easily discoverable yes -- but, they are also trivially discoverable by standard automation available today. I've found GPT-4 to be shockingly bad at vulnerability analysis for all except the most popular vulnerability classes. My speculation is that there just isn't enough literature on these vulnerability classes for it to have practical mastery of them.

Complex vulnerabilities are the emergent phenomena of multiple events across a codebase and it's dependencies, involving control flow, data flow, while missing type information and other runtime data. Even Anthropic's 100K context windows won't nearly fit it all, and if you stuff all the code into embeddings, the ability to reason across all this space will be poor.

You can train a model to ask very pointed questions about particular snippets, but wholesale LLM-based analysis to find vulnerabilities seems like it'll be extremely slow, expensive and inaccurate.

I said it seemed like it might be a novel addition to their practice, not to the state of the art.

The question isn’t “is this possible and has anyone ever done it” - it was was “has the FBI ever used a botnet’s existing C&C patch all the infected hosts”?

It doesn’t seem like it, but I don’t track this stuff closely so I’m happy to be corrected.

The FBI took control of the botnet and re-purposed it to patch the vulnerable machines. This sounds like a novel practice addition to me?

I've done some limited consulting in this space in my career, and I agree that the code (and architecture) I've seen is pretty brittle junk. It's on par with the worst enterprise code I've seen. It's a numbers game for them. And, it's just a different work experience and skill tree that drives people to create "great code" (as it would be measured in professional software development circles.)

First of all, clearly you have a ton of knowledge in this space, and I'm feeling very lucky I get to learn from your experience here. I have one more last question/challenge:

I totally get that we "treat the patient" -- that's sort of what I'm hinting at with the demographics. But, in my opinion this thing you said:

we don't have actual data about how much an extra X% outside of target ranges matters in terms of clinical outcomes and complication rates. We only really started getting this data with CGM and complications in these mild states would require very large cohorts and long (10-20 year) follow-ups to detect differences as they're likely to also be mild.

... is not the same as saying "we know that 70% TIR is safe to live with no complications". I don't think any of the guidelines are that confident, because there's not enough evidence yet. Consider this study (discussed at [1]):

Overall, increasing time spent with glucose levels in the target range of 70–180 mg/dL (3.9–9.9 mmol/L) was associated with decreasing risk for microvascular complications. For instance, 50.0% of the 10 individuals in the lowest category for TIR (<40%) had at least one microvascular complication, compared with just 27.3% of the 99 people in the highest category for TIR (≥70%).

Moreover, El Malahi said that the 180 people with microvascular complications had significantly lower average TIR than the 324 individuals without, at 60.4% versus 63.9%.

This suggests to me that a difference of 4% of TIR can seriously affect long-term outcomes. And, by the way, even those with the highest TIR still had microvascular complications higher than the normal population. On top of that, we know that genetic and environmental factors may be at play.

Therefore, my monkey math is that 75%+ as a TIR goal may mean that even if the patient is an order of magnitude more vulnerable to complications, microvascular or otherwise, they have a much better shot.

And, unfortunately, the typical western diet with 3 meals a day and snacks, you have to be "good at managing diabetes" to get to 75%+ TIR. Thanks for reading my ramble.

[1] https://diabetes.medicinematters.com/easd-2020/glycemic-cont...

https://replica.health

Oh my gosh, this is the startup I considered starting last year when this issue became personal to me and I wrapped my brain around the complexity of insulin dosing.

There are a lot of challenges here but we absolutely need an external "brain" to correlate many data points, some trends, and reasonably estimate current insulin sensitivity.

I think the "no meal announcement" features are really valuable for traditionally underserved demographics who, for whatever reason, can't "get good" at managing their disease.

The difference between how quickly food and insulin hit your bloodstream make it seem like there is no way to "algorithm your way out of" meal announcements. Food hits almost immediately, and with variable strength depending on macronutrients in it, and insulin takes ~15 minutes to start working, and peaks at 1 hour, with no concern about BG levels. Can you square these 2 for me and make it make sense?

It's not clear from their site whether the Inreda product also has CGM built into it, or if it must be paired with one?

Glucose-responsive insulin also seems like science fiction as this point, but would be extremely powerful tool.

I'm very familiar with one of the most popular, closed-loop system combinations in the USA and I definitely don't feel the hypoglycemia problem is anywhere near "solved". There is too much volatility dictating a person's insulin sensitivity that even today's smartest systems will regularly give too much insulin, requiring treatment, or too little, resulting in prolonged hyperglycemia.

I agree that time-in-range is incredible today with the technology, comparatively, but there's still lots and lots of room for improvement.

The detectability of failure is an excellent point. Anybody who uses the hardware can confirm it's not 100%. I think your point helps me re-frame the glucagon as more of an insurance backstop for when we accidentally hit the gas a little hard, rather than a permission slip to constantly be going too fast and constantly be slamming on the brakes.

Even in this framing, it still feels like an extraordinarily valuable addition, and relatively low risk. It's also, of course, more to add to the patient's maintenance, but might help them or their caregivers sleep at night.

Insulin lowers blood glucose, which of course is a vital tool. However, there appears to now be shelf-stable glucagon [1], a hormone which can be injected similarly to insulin and raises blood glucose levels.

AFAIK there is only one company, Beta Bionics [2], that is working on commercialization of such technology with dual pumps. In this case, you could be more aggressive in either direction of pushing BG, because you have a safety net.

Because this feels like a holy grail / functional cure, I'm surprised the incredible DIY teams out there haven't trained their guns on doing this. Having both "turn it up" and "turn it down" knobs seems so much more valuable than squeezing the last 5% of efficacy of AID systems. I feel like glucagon is obviously "the answer", but I don't see much talk about it.

Is the problem that there is no hardware for dual hormone pumps? I would have thought by now they'd have hacked 2 patch-pump AIDs to work simultaneously.

[1] https://www.medscape.com/viewarticle/947962 [2] https://www.thejdca.org/article/2023/06/05/fda-approves-beta...

If you RTFA you will note it specifically calls out the multiple models tested. It also points out that these are evolutionarily conserved pathways, so of course the translatability chances are higher than baseline. To top it off, some of those pathways have already been associated with increased healthspan and lifespan in many other studies.

I am interested in informed skepticism, because this is kinda compelling.

Disclaimer: I don't really know shit.