napoleond

It seems clear that LLMs significantly change threat model math, but this observation alone does not explain how or why; the asymmetry that you’re describing is a property of pre-LLM software as well.

Each of those examples varies widely, and I don't think most people would treat each of them the same way.

In general when the stakes are higher and the ambiguity of outcome is less clear, secondary signals become more important.

Concretely: I don't give a shit if my housecleaner doesn't make their own bed as long as they make mine; the outcome I need is easy to verify and the stakes are fairly low so the secondary signal doesn't matter very much. Conversely, I care a lot if the therapist I'm relying on to help me manage my depression is visibly unable to manage their own; the outcome I need has a slow feedback loop and the stakes are high so I'm much more likely to rely on secondary signals like "is this person able to manage their own mood successfully?"

It doesn't know if 1 person made all those requests, or N.

FWIW this is highly unlikely to be true.

It's true that the upstream provider won't know it's _you_ per se, but most LLM providers strongly encourage proxies like OpenRouter to distinguish between downstream clients for security and performance reasons.

For example:

- https://developers.openai.com/api/docs/guides/safety-best-pr...

- https://developers.openai.com/api/docs/guides/prompt-caching...

MoltOverflow is apparently a thing! Along with a few other “web 2.0 for agents” projects: https://claw.direct

Surely that’s not all it takes?

I took the trouble of logging in to HN to call bullshit on this whole thread. The reason these teenagers aren’t building standalone apps is generally because they know that web apps are the future. Moreover, there are dozens of new travel planning startups every year (YC regularly funds them!) and they seem to discover the same thing that Microsoft did—the real reason they stopped updating this magical app—which is that everybody wants better travel apps but nobody wants to pay for it.

I’m sure someone will crack the code someday and I’m glad they will keep trying, but I refuse to accept the premise that $100 Apple developer accounts are their primary impediment.

This year I launched https://www.tabbydata.com, on track to make $500/month by February.

Shoot me an email if you’d like—I’d be happy to share any learnings from what I built if relevant.

For other public BigQuery datasets I’d certainly consider just adding them to the demo for free—which specific Bitcoin/finance datasets did you have in mind?

For private datasets, we’re looking at adding that functionality to the core Tabby service (that’s the SaaS this relates to). Please email for info!

Are you looking to set it up for another public dataset or your own private one? Either way, shoot me an email (on the demo page and also in my HN profile) and I’ll see what I can do.

Thanks for noting this! The functionality is definitely not perfect, and the opaque nature of the underlying model does not give much opportunity for tweaking. I suspect slightly altering your input might help drive better output.

Really? Wow, I would not have expected that to work. Might be one advantage of using this general model instead of a more specialized one.

The weather dataset has a bit of an unorthodox schema IMO, which gives the model more trouble than usual. That’s kind of the point of this demo, though: to what extent is generated SQL like this useful—despite its flaws—in the context of real-world datasets? Jury is still out :)

Nice! Yeah I have no doubt that a specialized model could beat this general one, although I find the output from the general one to be uncanny at times. Would love to hear your expert opinion on how they compare!

Yeah many rough edges indeed. The generated SQL is the plain output from GPT-3; I have not done anything to customize the model or validate syntax outside it, so the roughness is expected. No idea if folks will find value in this despite that, hence the demo.

Awesome! Always happy to chat; my contact info is in my profile (and also at the bottom of the linked demo).

Cool! Yes, the ability to customize the model (https://openai.com/blog/customized-gpt3/) also seems like it could be really useful for this.

Clickable link: https://app.tabbydata.com/sql-assistant-demo

In terms of actually tracking and charting this data, it’s pretty useful to have it all in one place and queryable by SQL—this is not usually the case by default!

I built https://www.tabbydata.com for SaaS founders who have this problem.

This is a great overview of what to measure, at least for business metrics.

(Shameless plug…) For folks wondering how to measure, and also how to track product metrics for their SaaS, I wrote a thing: https://www.tabbydata.com/book

I think this is why most sites—especially those targeting technical audiences—should rely on server-side analytics instead. Add some middleware to your web framework of choice which logs request data and parse that, or use something like https://www.tabbydata.com (disclaimer: I built that) to pipe it into a data warehouse. Voila! No JS tracking, retain useful metrics.

And how did you verify its integrity? And what is the upgrade path?

Looks like someone from the security or PR departments took a picture of the ticket with their cellphone and sent them to the reporter.

Out of those two groups, Occam's razor implicates the one with a vested interest in currying favor with reporters.

n8n and Node-RED are both really neat! Over the break I built a little project that takes a different approach; for me the schleppy part of API integration is not usually the code but it's the infrastructure (where to host for cheap, with a simple deploy pipeline, maybe scheduled execution, etc). https://www.tabbydata.com/glue is a little thing I built so that I don't need to think about those things again.

https://whimsical.com/ :)

(Disclaimer: I work at Stripe, but commenting purely in my personal capacity.)

I wish I could buy stock.

Something I wish I'd internalized much earlier in my life: if you're a programmer or otherwise have skills relevant to a startup (many HN participants fit this bill!) then you do have access to stock in companies like Stripe. In exchange for your time and expertise, they will pay you in both stock and cash.

My contact information is in my profile and I would love to help anyone I can in this endeavor.

I was curious about this so I dug up an early comment thread about Theranos: https://news.ycombinator.com/item?id=6349349

There is some optimism about the Theranos mission, and a lot of skepticism about their implementation. Most of the comments are centred around the composition of the board and (correctly) surmise that the lack of medical expertise is a huge red flag.

Your comment seems like a variation of https://en.wikipedia.org/wiki/No_true_Scotsman. The parent commenter says "I personally experienced X and it was not great for me" and then you say "what you experienced could not have been X, because X is always great for people."

I call bullshit. The sort of attitude expressed in this thread is important, because it pushes us forward. The author identifies real UX shortcomings with current software. Nevertheless, the assertion that "almost everything on computers is perceptually slower than it was in 1983" is patently false, and the comparison between online maps and paper maps seems almost intentionally obtuse. Yes, online maps could have even more capability and better UX than they do today. No, it is not more difficult to conduct mapping activity today than it was in the 90s. (For instance, the example given about finding interesting places to stop along a route: the 90s equivalent of that would have been a book, separate from the map, not searchable, and full of things completely irrelevant to your interests. So yes, maybe putting a mark on a piece of paper is easier than doing it in online maps, but every other aspect of that process is way harder without the internet.)

I have a similar observation around the idea of "working in public" by, e.g. blogging or tweeting a lot about your work. Proponents of this approach say that it will help your career immensely, and while I believe that it can I've also observed that the most successful people don't spend a huge amount of time blogging or tweeting about their work.