3,165 karma · joined August 5, 2012
https://www.evalapply.org/about.html#standing-invitation
(In the tradition of HN denizens like sivers and patio11.)
> but I'd like to highlight some of the more esoteric books which affected my thinking
In the same vein, James Hagues's whole blog is wonderful; well-informed, witty, funny, incisive, insightful, with personality... I learned much from avidly reading it, while he was actively publishing. Thanks, James!
Also, I am cracking up at the construction of the site subtitle... It's not just tongue-in-cheek. It's also funny and with the times. :p :)
Paraphrasing:
The only way to secure a computer is to not buy one. And if you buy one, to never plug it in. And if you plug it in, to never switch it on.
Something like the cheapest way to own $GasGuzzlerWithItsOwnPinCode is to bring it home after purchase, and set fire to it in the yard.
Still, I'd guess that the odds of remote exploits are better if one wants to control a device via the PSU-as-backdoor, versus exfil data from it. Do like the IoT people and UDP broadcast naughty control signals to the power circuit / subsystem that has the compromised device.
Guessing further, remote exfil will mean having a close-proximity wiretap into the precise power line circuit of the target infra---because of signal losses---it could still be UDP broadcast exfil. Or a physical tap at whatever power transformer is the single point of connect between the target and the main grid. And if you can't get anywhere near the installation, well you can't exfil, because AFAIK it's pretty hard to reverse a signal up a transformer back into the main grid.
A scan of the arxiv paper appears to suggest similarly---the situation they describe presumes a wiretap into the circuit or the mains switchboard.
brb reviewing some EE material...
But don't expect much from me... I wanted to do a final year project in Power Line Communication for my electrical engineering undergrad. Then-me decided it was a dead end... cannot go WAN-scale; too much line noise and signal transmission power loss. I did something else with power electronics---I can't remember---but then again, my undergrad was also a dead end :p
Me: IDK, running JavaScript... of some sort.
But seriously... The post got me wondering if one could (even crudely) fingerprint the make, model, and vintage of $AnonymousLanguageRuntimeBinary, by triggering a "sort fail" style complexity explosion of, well, sort, but also perhaps other common Big-O-sensitive language apis of standard libraries.
Organisational (mis)behaviour---corporate and government---is simply a product of our widespread and deeply rooted feudal-bureaucratic mindset. One that both fosters and then feeds on the divisive complexities crafted from exploiting age-status, patriarchal conventions, and class and caste and religious and ethnic identities.
We are a sublimely chaotic heterogenous people. The best of us have---through the ages---been finding ways to cooperate and co-exist without giving up what they cherish most about their ways of life. The worst of us manage to always fault someone else for all their troubles, and then further incite others to do the same.
> Well, I honestly believe it is rank incompetence. Speaking as someone who's monthly electronic GST filings, commercial authentications, and digital payments, i.e. continued livelihood, is beholden to cert and PKI authorities like eMudhra having their shit together...
> [SNIP ... Wall of Speculation ... ]
> In conclusion:
> I'm confident all federal administrations of India, current and future, will hold the lawful means to act wilfully, crudely, with impunity, at scale against India's own citizenry.
> I'm not sure whether they currently have enough incentive to have used the eMudhra cudgel, to disrupt the protestors. Sure they could MITM the protestor websites, but it's so much easier to block them and takedown their socials. And for more specific work, they already have field deployments of Pegasus and other MITM / spyware technologies.
(edit: simpler link to x-post)
Speaking as a citizen, ignoring "all those bloody foreigners amplifying this on social media" for a (very very brief) moment to dwell on (suppresses gag reflex) ideological "national security" rhetoric which these people no doubt kowtow to (eMudhra's head honchos and board, the central ministry MeitY etc.)...
How have they not proactively taken out all stops to fix this already in their own house? On a national-disaster-scale emergency footing, which this is!
Realities are arrows. Time marks flight. UUIDv7 is Time.
(Yes. Yes. No, hell no, not after what Robert just told ya.)
https://www.evalapply.org/posts/poor-mans-time-oriented-data....
The small saving grace for me is that, despite my broken mental model of UUIDv7's time and monotonicity properties, I get to also use SQLite's automatic rowid for ordering and disambiguation. That too, only because I can (still think I can) get away with a "DB per tenant" architecture. Nevertheless, the same breakage potential will return when (not if, when) I have to mix / remix records from two or more DB files.
brb, investigating whether I can reliably construct UUIDv7s using db-time...
Shameful beyond words... The head honchos there should be severely punished---and then made to stay on permanently as rank-and-file demoted operators charged with making sure the org does its day-to-day work better---waaaaay better in the future.
As for the odds of this being state-sponsored... It depends on the state's incentive, weighed against its continued behaviour, over the last 10-odd years. Everything below is easy to substantiate with citations. There are too many to cite... I put myself at real risk just by stating any of the following under my real name.
---My take: Never attribute to malice, what one can to (rank) incompetence.---
Basic day-to-day operations being unavailable, because "Sorry sir, site is down." is a normal everyday life experience of their own staff, not to mention the common person. eMudhra is one of that tribe, and I'd say they are not the worst offenders of the lot, by a wide margin. I'd probably give the "best of the worst" title to our national Employee Provident Fund.
Of course, one can't totally rule out nation-state-level stupidity, such as BGP poisoning by the Pakistanis.
---Nation-state action: Wither sufficient incentive? ---
In India, absolute majority governments have amply demonstrated the same failure mode as US heads of state empowered with de-facto fatwa powers, as of the US PATRIOT act. Given motive and incentive, they easily turn the full might of their uncheckable wrath and ire at our constitution, as well as directly at the common public.
You know, like sending out military forces to "calm down" the pesky student protesters acting against "the national interest".
As we speak, massive nationwide student protests have been bringing shame and angst to the government of our ruling party at the centre (BJP and allies), as well as their various governments across states. Many protests have happened at this scale in the last decade+ of the same ruling party's unbroken streak as a majority power in the centre (federal government). Those other protests were like water off a duck's back. The ongoing student protests, for reasons I've not dug into, appear to be a clear and present existential threat to the incumbents.
My gut feeling is... the incumbents aren't passing the electoral vibe check any more.
The sentiment on the streets of the national capital, and large urban centres nationwide---almost entirely comprised of a new crop of young voters (18 y.o. up to early 30s)----is that they feel robbed of an economically viable future. They've organised at scale (millions on the street) with persistence (they are literally owning the "Cockroach" epithet thrown at them by the powers that be). And in short order, material consequence---unprecedented in its decade-long winning streak so far---befell the incumbent party's administration. The Education Minister had to resign, and they've generally lost face with that whole voting-age cohort. Brand-name loss of key leadership is further disrupting their internal party cohesion. Plenty of hopefuls in there, salivating after the top dog position, but thus far too weak to sway the cult following of the public faces of the party. Even an hint of weakness gives the wannabes a real opening to try. Textbook demagoguery.
If that is indeed true, then in their place, I too would seriously worry about losing even more ground in the next national election... It's not far now. Because? "Winning by overwhelming majority" has been the one and only priority of the incumbents, driving all their work post-election (where work includes constitutional shenanigans)... Being a populist party borne of, and cultivated by far-right nationalist ideologues (the RSS and "Sangh" community), with a longstanding desire for religious supremacy (Hindutva and Sanatan dharma), they publicly and loudly dream of a hundred-year golden age. Uh, no, now I think it's become a thousand-year era (really!). That's not totally insane if you're suddenly goated at winning electoral politics, because our head of state can enjoy unlimited tenure. Yes, you heard that right, India has no constitutional limits to number of re-elections to the Big Chair, whether successive or alternating.
Without looking at absolute numbers, I feel confident that the influx of new voters (lots of people can turn 18 in a single government tenure) far outstrips the older ("whatsapp uncle / aunty") voter base that the incumbents pander to. This has been a lucky break for the fumbling Congress party because their legacy name is finally regaining some cachet... The much-mocked Rahul Gandhi presents like someone the young'uns can actually talk to, like a human being.
But the Gandhi-brand Congress were once an absolute majority power too. At which time they suspended our constitution, and weaponised federal agencies, and created the playbooks that all future governments have been able to deploy at various scales. I expect nothing less from any other party that grabs absolute majority. Currently it's the BJP. Tomorrow, it could be anybody else. Thus far, it's been the secular-presenting Congress, followed by the Hindutva-majoritarian BJP. Woe betide us if next the Communist Party of India gets a bite at that juicy apple. 'cause, like, I don't have to explain what that sort of government can do with absolute power. <shudders>
---Nation-state action: Whither evidence of having the means and using them with impunity?---
Ref: at-scale weaponisation of Pegasus, as of 2021. Federal and even state authorities like police departments have weaponised nation-state electronic warfare technology with impunity. Usual suspects / targets are politically inconvenient individuals and groups... opposition politicians, bureaucrats with a spine or conscience, students, media, artists, NGOs etc...
All this mixes badly with pre-existing supercharged Sedition laws. These effectively obviate habeus corpus, and are routinely used to prosecute speech interpreted as anti-national / seditious under the generous ambit of our IT laws (we don't have a real privacy law). Mere suspicion and/or fear and/or dislike + Pegasus + garbage IT laws = authority can brazenly plant incriminating evidence on your device... it's reportedly been done multiple times.
People have been held in prison for less (just inconvenient speech), without possibility of bail, for months and years on end, without trial. The main goal is to cause irreparable reputational damage, to create future deterrence... It's pretty effective. A secondary goal is to take the stubborn ones off the board, with no legal recourse, until they break. And of course, to permanently defang the truly outspoken and indomitable few... Some of those people have been in high-security federal prison for years on end now.
In conclusion:
I'm confident all federal administrations of India, current and future, will hold the lawful means to act wilfully, crudely, with impunity, at scale against India's own citizenry.
I'm not sure whether they currently have enough incentive to have used the eMudhra cudgel, to disrupt the protestors. Sure they could MITM the protestor websites, but it's so much easier to block them and takedown their socials. And for more specific work, they already have field deployments of Pegasus and other MITM / spyware technologies.
> Lynn Margulis [14] has made strong arguments for the view that mutualism is the great driving force in evolution.
> ...
> [14] Margulis, Lynn and Dorion Sagan, _Microcosmos, Four Billion Years of Evolution from Our Microbial Ancestors_, Summit Books, 1986.
Not uncommonly, people are salty in the comments. Mostly it's fun to ignore the salt, and let the community do its thing, while also trying to observe what's going on with my feelings. Sometimes it's fun, or necessary, to show up and respond to flip the thread from destructive to constructive. This is a skill I can get better at, and I feel my odds of being better are higher with topics I've thought about for a good long while, and so that balances out in favour of taking the risk to self-share.
It so happens the eyesore "pick me!" links are gone now, except they are in a draft layout refactor. But please don't ask I know when it's going to go live. Could be tomorrow (or rather today---it's 2am here---and in that delicious sleep-deprived fugue state say eff this, I'm done, send it).
Or it could be next year.
(:
For half a second I read the rest of it as "a thousand Bitcoin", and immediately thought "okay, so there's a story here about how it was way early and how you tipped someone else, and now, just look at them, wow".
(edit: also, cool blog yourself... subscribed!)
Also, the posts are structured to the way I have come to arrive at some conclusion, or some understanding. So it is very much written for my own benefit, and incidentally shared because well why not. Surely I'm not the only one who was confused, or ignorant, or just curious about $Topic... Just don't expect that I will rewrite the thing for some abstract audience persona and how their brain works. If something is weird or unclear or plain wrong, search is at hand. And if something is annoying, well there are certainly lots of other places to go to instead. So, no, I don't really think about who reads my stuff. These days, it must be all bots anyway. So be it.
But I do like to also "learn generously", and I love to share and talk the about stuff I end up publishing from my drafts and notes (which far exceed the stuff up there in public view). So when I feel like it, I share links in various places. Usually its crickets. Sometimes there is conversation.
The "share to HN" etc. stuff is in service of prompting people to share if they feel so inclined. And honestly, I don't think people share via those links. No data, just gut feel, given how long the site has been up, and how uncommon it is for not-me people to post links to HN.
As for the prominence of said links. It has been an eyesore and a long-pending thing to delete. Sometimes I use the site as a playground. That time, I wanted to see if what "they" say is true about putting sharing links up top, prominently. So I slapped that section in, during one of the layout refactors.
And so, the top of the posts got way too busy with those "see me! pick me! choose me!" links, and stayed because I couldn't bring myself to refactor yet again. (Also because there's not much to lose because someone got annoyed at the eyesore click-share links. Yeah, friend, I'm annoyed too. Sucks to be us.)
(edit: expand comment to clarify some thoughts)
Honestly, I think there is value in having lived in "idiot mode", because that is the feeling I walk around with most of my life. And thinking is hard, so I don't want to, most of the time, but then I have to, because who will pay my bills otherwise?
Some of those posts are, in fact, because I felt like an uncomprehending idiot, about the blog post's topic, for the longest time ever. And it turned out that I was holding it completely wrong, or had pop-cultured myself into a prejudiced (therefore uninformed) opinion. Then, once some clarity arrived, I wanted to spool it to disk before it evaporated again. And lo and behold, post emerges.
And, allow me to add antipattern no. N, in full display in the posts below: A 1:1 ratio of main body to footnotes, because we want some place to put all the spicy asides and hot takes.
What to do, my brain struggles with brevity :)
Exhibit A:
Exhibit B:
Exhibit C:
Exhibit D:
(edit: reorder + fix formatting for clarity)
---
Now, to die on this hill.
Speaking as someone who desperately wants people to stop inventing syntax, I want to offer my "inversions" of the author's conclusions.
> prefix notation puts parentheses further apart
Prefix notation guarantees that I instantly know what the function / operator is and what the operands are. I don't see (or care) to literally read the parens. The parens are not the point.
And if we are doing this, let's compare real-world code shall we?
For example, how many syntax points (like = and ; and whatnot) do I not have in this code block (of my dotemacs) because regular prefix notation means I can set any number of global variables in one single declaration? https://github.com/adityaathalye/dotemacs/blob/3ce80d8336ae8...
As a bonus, because of the prefix guarantee, when teaching someone a Lisp, I spend almost no time teaching the semantic meaning of syntax rules. All I have to do is show how prefix notation works, and drill that a few times with hand-coding exercises.
> formatting practices do not help to track parentheses
Auto-formatters---once again, because of prefix notation---can lay out code in very regular patterns and shapes. Auto-formatting further obviates the visual / aesthetic relevance of parens.
Not to mention smartparens and structural editing and other basic niceties of Lisp text editors.
> prefix notation results in more left-nesting
Perhaps. The value for me is that it results in more regular code, because, once again, standard prefix notation, and once again, standard auto-formatting. Nobody reads closing parens, or opening parens, or whatever other parens... we let our text editor take care of that stuff for us.
> Lisps lacks or discourages features that align the evaluation and reading order
This depends on whether the Lisp in question is imperative, procedural, or functional. It has nothing to do with S-expressions...
Essentially, the author makes the usual category error of conflating "Lisp" with "s-expression".
May I suggest associating "Lisp" with "Metaprogramming" as the better evil? Die-hard Lisp-2 nerds will balk, but I say any language with an ability to symbolically manipulate itself as its own data is a Lisp. For example, Julia is a kickass Lisp because it enshrined meta-programming as a first-class language design concern. Ditto Elixir. I'm happy thinking of those as M-Expression Lisp-likes.
And as a matter of personal taste, having been around lisp nerds, nobody who actively writes s-expression languages---even as hobbyists---reads parens. They/we see shapes and we manipulate our code like tetris, without even having to think about 'em parens, and soon enough, nor about the keyboard shortcuts.
Whether Emacs, or Vim, or VSCode, or IntelliJ or, whatever Lisp-aware editor, we simply slurp and barf and splice and unsplice and convolute-sexp, all of which I do as a normal part of Lisping https://emacsrocks.com/e14.html ... And this stuff is so readily possible because of the regularity of prefix-notation s-expr syntax.
(edit: add code example)
But also, sticking with it and making the retry happen---that was all you, robto. Our experience was pretty much that almost no-one we made our office-hours offer to, took it up.
Also, unrelated --- idle.horse --- fun domain! Is it an email carrier only, or does it have a future in public service, as a not so idle blog / site / memex content delivery beast too? :)
I interpreted hiring as optimal stopping problem because:
(a) we as hiring managers have no idea who's out there that we can hire and train for our requirement, and
(b) traditional hiring pipelines have a retry limit of zero; once rejected, rejected forever, and the open-door retry policy makes it infinite retries (after a cooling off period).
So the idea is to process applications as fast as possible to reject negatives and false positives, at the possible expense of some false negatives. And then try to defeat the downsides with the open-door / infinite retry trick.
That is certainly not exact science. Besides, I'm not a stats / maths / operations research person though, so I do accept I could be wrong. For now, I am okay being wrong because I hope to never have to hire anybody as an indie software builder :D
I've seen one or two software companies that are explicit about this. If memory serves, Jane Street is one example. These companies explicitly say in their "regret" emails that one can re-apply after six months of the last application.
My colleague and I worried about the same things back then. It turned out that because we imposed hard constraints on ourselves, we fairly quickly built a system that we could run under those constraints.
Particularly the office hours offers... We had a feeling not many would take it up, but we were not sure. But we were also not sure if we could pull it off along with our day jobs. At the end of it all, our guess was correct.
A reason I decided to publish it is because it was not exhausting! That's part of the "unwitting" part :D
Also, being able to make the steps ourselves was key. I expect nothing but exhaustion and disaster, if those hard constraints are imposed on any pre-existing hiring loop, and the interviewers have no say in tweaking the system.
Yeah, that's the danger with writing a first-person account. Easy to read it as self-adulation. And detailing one's operations in that vein makes it look like lots of back-patting. That said, it is what it is; for a blog post, like a book, is written twice---once when the person types it out and once when someone reads it.
The difference is in how we ran our, otherwise normal-seeming, interview loops. Speed, async-first, clear up-front communication (no corporate speak), and open-door policy all compose and work together.
Viz. if Language is compression (of thought / culture / the tacit je ne sait quois of being-to-being communication etc.), then definitionally, Language Modelling must also be Compression.
Except, language is an arbitrarily lossy compressor, who's "compression-prediction equivalence" is indeterminate and unstable, because Language co-evolves constantly; both as a function of or response to culture, as well as an influencer of culture.
So, the subjective-objective goodness of Language Models (of any kind of language) would be, at best, upper-bounded by the compression-prediction equivalence of the Languages corpus itself. And that is assuming the language corpus is perfect in every way---it captures all knowledge expressible by language and it is always in-sync with live evolution of all language expression and evolution (i.e. LLM training is not a batch job, but a real-time present continuous process).
For example, to my layperson eyes, the mathematical language of proofs actively weeds out ambiguity of subjective interpretation. Ideally, a proof ought to lead to the exact same conclusion on every single reading by any reader who can follow the steps. A proof also holds only if the rest of the formal, explicit, inviolable, internally-consistent set of axioms and results holds.
So it stands to reason that mathematical prose of proofs, being optimised as mechanical procedure of taking an open question to a deterministically closed solution, has better odds of approximating the tacit aspects of mathematical derivation.
Which makes an LLM able to construct a mathematical proof, which is mind-melting to say the least.
However, I wonder, can LLMs dream of mathematical sheep?
I relate strongly to SanjayMehta's comment, as a hiring manager, on a previous submission [0]. Plus, I read comments from so many job seekers, in software nerd slacks and discords, echoing the other side of the same pain (ghosting of course, but also... being sent rejection emails for stuff they didn't even apply for!!!).
It feels like LLM-AI augmented job seeking and hiring pipelines, along with LLM-ification of software organisational functions, have exacerbated the zero-sum-ness of the de-facto method of software hiring (multiple interview loops with coding and whiteboarding tests --- human evals, in a real sense).
viz.
*Severe, if not total, disruption of signal to noise of competence criterion.*
The ability to program, and to whiteboard-solve algorithms and architectures has been, for better or worse, adopted as the main criterion for programmer / software technician's competence. Unlike other professional fields we have to rely on explicitly visible evidence of on-demand performance.
Surgeons, civil engineers, professors, lawyers, bankers, accountants, even writers and poets etc. have to satisfy well-accepted professional criteria and come with referrals and they are able to show track record "out there" which is impossible to hide from anyone who knows how to look. Plus their conduct is held in check via explicit board reviews, as well as civil and criminal law.
The industrial programmer has little going for them in all these regards. Even job titles are meaningless... one company's principal engineer is another company's "L6", or whatever the hell that means.
*HR automation*
Companies can churn out job posts faster, and conveniently (but certainly not effectively) run many more people through LLM-automated hiring loops. Pretty sure a whole bunch of internal incentives are also getting gamed... "How many candidates did you evaluate?", or "What is the quality of your hiring funnel?" Well, synthetic candidates, and synthetic interviews can certainly help one's cause here.
*Applicant automation*
While job seekers are able to also automate their resume/cover letter flows, as well as portfolios and "content". The clever ones are able to automate themselves as well, and hold more than one job. Company layoff culture has not helped matters at all---if employers are out there saying "AI can do your job", then they have no standing if the other side turns around and says, "cool I can do many jobs as AI".
Its already become a runaway effect, I feel. An Ouroboros death spiral of automated content generation / summarising / filtering --- where software programs are also just "content" now.
You know, 'cause it is so darned easy to conflate tacit knowledge work with explicit (mechanical) "content creation".
[0] https://news.ycombinator.com/item?id=48712695
> SanjayMehta 85 days ago [–]
> Re: ghosting - this was the single biggest annoyance when I was hiring en masse.
> The HR executives would ghost both potential hires and no hires, because they couldn't be bothered to keep track (or they didn't understand the nuances.)
> Our successful hiring rate went up when we cut HR out of the hiring loop, contained them in salary fit and background checks. The hiring manager was responsible for keeping candidates informed.
> We kept diaries to keep track of potential hires and periodically went through them before starting a new search, something which recruiting agencies would charge us to do, but never did.
1. Universal Inter-Process Interface: Arbitrary program composition via the Standard Input / Output / Error interface, and "everything is a file" abstraction... None of the rest is possible without some such core design decision ("everything is an object" is the fraternal twin).
2. Widespread standard utilities: The broad availability of core util tools designed to cooperate via the same abstraction is a close second. Along with some default scripting language, that is also built for the same computing model.
3. Language of choice: Important for ease of access, but a distant third in terms of raw power, be it bash, perl, awk, node, clojure (babashka) etc. That's icing on the cake, because if one had no choice in the matter, the shell program would still be awesomely powerful. Proof is in the pudding---"scripts that matter" are always /bin/sh.
Generally speaking, the pain of learning to avoid sh and bash footguns is primarily a matter of some basic research reading: manuals, lore, and warnings (I love BashPitfalls). Well, either that, or learning the hard way by copy-pasting code, and if luck runs out, rm -rf ing something you shouldn't have.
There is no substitute to taking the day or so to read the manual, so you know it's a lot, but it ain't magic, and you can eat that elephant one bite at a time, at your own pace. Seriously... the wall-clock time of trial and error with BashPitfalls (about a day or so), is nothing compared to learning to use---and then having to re-learn every so often---the python or node or whatever ecosystem without losing it. Besides, the former knowledge is stable and so are the programs --- my Bash code will keep working the same way, forever, practically speaking.
One day, I tried to demo Groove in our weekly company-wide morning show-and-tells.
I had a few of our "usual suspect" files synced between my laptop, and another computer upstairs. And then I tried to show how I was making edits on one computer, then (dramatically) running up to the other one, and doing something else, or undoing / overwriting the previous edit.
The magical-to-me seamless, and fast updates didn't make much of an impression on the crowd. Perhaps all the huffing and puffing was not the best look while trying to sell something that was supposed to make everyone's life easier :,)
Anyway, I kept using it and was so hopping mad when it got "embraced, absorbed, and extinguished". Software that "just works" and works really well is such a rare thing.