HNHacker News
TopNewBestAskShowJobs

borski

7,420 karma · joined May 27, 2008

Just a hacker in the SF bay area who likes technology of all sorts; cyber security expert, founder, angel, advisor/mentor, and singer/musician. :)

I run the Agentic Red Team at Google DeepMind.

I have always been more interested in why and how things worked, rather than just being content that they did.

20+ years in offensive software security, eight patents (I hate them but tell that to the VCs who love them)

Sold Tinfoil Security, after 9 years of building it, to Synopsys, in January 2020. Hell of a ride.

My (last) startup: https://www.tinfoilsecurity.com acquired by https://www.synopsys.com

Twitter: @borski

borski@owlpost.lol -- get in touch! I'm always up for meeting interesting people.

[ my public key: https://keybase.io/borski; my proof: https://keybase.io/borski/sigs/-cfyFmMrqV_tAh69m5bO-EY3t_gllRR0ODZqOa7E0E4 ]

submissionscomments
borski··on Gemini Hacked Three Companies in First Known Breakout by Google's AI
Even if you had it internally (which we do), there is so much surface area and it’s such a novel space that you’d want as much testing on it as possible. There aren’t many vendors, and irregular is one.
borski··on Gemini Hacked Three Companies in First Known Breakout by Google's AI
We’re hiring. :)

(And we’re fixing many of these things, but worth noting this happened at a third party vendor, not in our lab)

borski··on Gemini Hacked Three Companies in First Known Breakout by Google's AI
There aren’t many to choose from, and admittedly these all occurred around the same time.
borski··on Gemini Hacked Three Companies in First Known Breakout by Google's AI
It happened in May; it just wasn’t public until now, it seems.
borski··on FDA authorizes first wearable device that monitors ketone and blood sugar levels
Indeed.

hack the planet.

borski··on FDA authorizes first wearable device that monitors ketone and blood sugar levels
T1, in both cases.
borski··on How credit card rewards became a $9.2B wealth transfer
That is not true. This hasn’t been the law for many years.
borski··on How credit card rewards became a $9.2B wealth transfer
That is not true: https://www.lawpay.com/about/blog/credit-card-surcharge-rule...

It used to be true, but this changed many years ago.

borski··on FDA authorizes first wearable device that monitors ketone and blood sugar levels
Dan was a spectacular brain, and made contributions that still echo today.

He is one of two friends to have passed from DKA. Miss you, Zach. RIP.

Miss pwning with you.

borski··on Claude: System Prompts
You acquire karma through posting things that are interesting or curious enough that others upvote them.

Thus, you build reputation by acquiring karma.

It isn’t perfect, but the fact that folks with higher karma can “fix” the emotional flags of folks with lower karma, it helps.

Also, I’d recommend re-reading the guidelines: https://news.ycombinator.com/newsguidelines.html

borski··on The Government Is Monitoring Anti-Flock TikTok and Instagram Accounts
Sheriffs are elected (except in New York City, Rhode Island and Hawaii) and responsible for a county whereas a police chief manages law enforcement in a city or town and is appointed by its local government.

There are a lot of sheriffs.

borski··on Claude: System Prompts
Flags also require a minimum karma, and members with yet higher karma can also undead posts, if needed.

HN is actually surprisingly good about this, so I disagree with your assertion.

borski··on Semaglutide linked to lower predicted dementia risk
You’re on too high a dose. The highest dose made me a vegetable, with no energy, and so on. That is not the way.

Lower the dose (with your doctor, of course). For me, the “middle” dose was the sweet spot of positive effects with minimal side effects.

You are likely a “hyper-responder” to GLP-1s.

Also, tirzepatide had far fewer side effects for me, fwiw.

YMMV, of course.

borski··on Semaglutide linked to lower predicted dementia risk
What dose? Have you considered lowering it?
borski··on The Human Is the Loop
> Well if Paul Graham says it, it must be true.

I didn’t say that. But when he’s right, he’s right.

> Think you could beat it in a specialized version of "business strategy jeopardy?"

> It would crush you. Thinking you know more about "business strategy" is laughable. What sort of guru are you? Let's see the great business strategy you've implemented.

This is no longer a productive conversation. I never said I would make a better consultant than an LLM. I said that consultants are useless without context, as are LLMs.

They are tools, not a panacea.

Have a lovely rest of your week.

borski··on The Human Is the Loop
Relevant essay: https://paulgraham.com/simply.html
borski··on The Human Is the Loop
> Prose? Don't care, I'm not writing literature, I'm delivering a message. If AI helps that be more clear and faster, great.

Writing well is not easy. PG has written many essays about this very topic.

LLMs do not write well.

> Strategic thinking? The LLM has more context than you. Sure, you know more about your company, but AI knows more about the rest.

This is a mistake, and untrue. The LLM has more general knowledge, yes. But it’s the specific knowledge (aka “context”) that makes all the difference. It’s the same reason management consultants are, by and large, useless; they aren’t dumb, but they lack context.

So no, the LLM doesn’t have more context than you. In fact, its context window is literally limited. You have decades of experience and knowledge and patterns you’ve matched, and the LLM has none of that.

Do not fool yourself into thinking it has more context than you. It doesn’t. It has more knowledge. Those are very different.

(Incidentally, the same is true of humans; the most knowledgeable ones are not always the ones making discoveries or changing the world. Often, it is specific context that matters more, as the application of a solution to a problem requires seeing the right problem. LLMs are a solution engine, but they have no metric for what is a “right problem”)

borski··on The Human Is the Loop
Sure, but if you’re influenced by how AI writes, it stands to reason that you’d be influenced by a great author too, and that may help improve your writing.
borski··on The Human Is the Loop
Yes, but people forget that. And when LLMs make it feel like you can offload “for free,” people find themselves trying to do everything.

LLMs provide you with the illusion of “free concurrency,” and it sucks people in.

borski··on The Human Is the Loop
This is a great point. I hadn’t considered the analogy to “more lines of code”
borski··on The Human Is the Loop
Yeah, I think that’s true, but that isn’t really my question. My question is why this seems easier and more natural for people with ADHD to do than people without.

(That is also an unproven statement, obviously, but that’s what I’d want to study/test)

borski··on The Human Is the Loop
I honestly think it’s the latter. OP’s post is literally evidence of that. The “open twelve agents” is not only unsustainable (and leads to burnout) but fundamentally incompatible with building robust software. Sure, you can have agents fight it out, but at what mental (and actual cash) cost, and to what benefit?

I have not found myself less productive than my peers, but I have found myself less scattered across a bunch of different things. I do not think this is worse.

Also, consider reading about and/or getting tested for ADHD. You may not have it, of course, but I was diagnosed at 33 and it changed my life. Not because of medication (though I did that for about a year and a half, with success) but for a dozen other reasons, including being able to accept parts of myself rather than fight them, recognize (and reinforce) the coping mechanisms I’d built, recognize the ways in which it made me literally better than other people at certain things (some refer to ADHD being a “superpower” which it can definitely feel like at times), etc.

If you haven’t read Mark Suster’s posts about his experience with ADHD, read them - there are 3. If it resonates, consider talking to someone.

My email is in my profile; I’m happy to chat if you ever want. :)

borski··on The Human Is the Loop
I don’t know, there may be something to this. I shared this post with another ADHD friend of mine and he also resonated with your and my experience, not the OP’s.

Now I want to do a study!

I wonder if the extremely fast dopamine hits of LLM use trigger the same sort of dopaminergic response that ADHD does when faced with a stimulus? If so, are we simply better at dealing with those swings, since we’ve literally dealt with them our entire lives?

borski··on The Human Is the Loop
It isn’t writing the post. It’s doing research, providing background knowledge, evidence, etc… but the work is being done by OP.

That was my read, anyway.

borski··on The Human Is the Loop
I think you misunderstood; the point was that not being constantly in front of Claude or another LLM is what has freed OP up.

That is, stepping away from the laptop is what has given them back some free time and brain space.

borski··on The Human Is the Loop
I could not agree with this more.

Just because you can doesn’t mean you must, even if everyone else is.

borski··on The Human Is the Loop
> I get taken in a lot by technology waves, hoping things will get better, but I haven’t ever crisply defined “better.”

Yeah, I think this is the issue more than anything having to do with LLMs. It’s also why I stopped switching to the latest JS library du jour many years ago. The one I had worked fine. I don’t need to learn React because it just came out after learning fourteen other paradigms / frameworks.

> Or my criteria has been too loose and I conflate novelty with progress.

Yup.

> If advanced models eventually accelerate science and medicine so that more people can lead healthy fulfilling lives, that sounds a lot better.

Agreed.

> But if a model helps me use an undocumented API of a random IoT device tomorrow, I don’t think anything is much better, and I didn’t even get much out of the process.

Disagree, but it depends on what you’re looking to get out of it. Is the interesting part the RE / discovery? Or do you just want to control your car from Home Assistant?

That is, once you’ve RE’d a React native app, you don’t really learn anything new by doing it again. I have no problem with an LLM helping me with that.

But if I want to learn to RE a binary or app? Then I’ll do that!

borski··on The Human Is the Loop
I find it interesting that so many of my friends resonate with this. I… don’t, really.

I only ever have 2-4 opencode/claude tabs open at once. And I use them for consistent tasks. There’s no way I’d be able to keep track otherwise. I have an “email reviewer” terminal, and a “doc maker” terminal, and 1-2 “coding” terminals.

But I don’t start a half dozen things simultaneously (which is ironic, because I have ADHD). I don’t feel the need to maximize my efficiency with AI. I also don’t lament the ideas / things I start but don’t finish; that has been my life, lol - see the aforementioned ADHD. So why should I start caring about my half-finished projects now, just because I sunk some tokens into them?

I spent an entire day the other day trying to use an LLM to help me automate something manual and tedious, and it was a failure. Did nothing but waste time in the end. Perhaps it’s those experiences (of which I’ve had plenty) that help me realize the limitations?

I don’t feel like it should make me more productive; it does, because I can offload random tasks that I do not have to be the one to do (“find the function where this happens” or “find all the laundromats in the cities I’m going to”) but I use it for research like that, and not so much “do my taxes for me.”

That’s why I paid a guy to do my taxes. I don’t feel this “need” for sending everything into AI. And just because I can use it to do anything myself… why should I?

There are two caveats:

1) when I’m directly working on something, I don’t want to leave it. I’m hyperfocused on it. But that’s true even without AI; I would have been obsessed with building doughflow.app were it for AI or not. The difference is I may never have finished it without AI.

2) I find myself using it as a crutch sometimes for simple things like sending a message to a colleague. I don’t like that, and have been trying to avoid it. I’ve spent all my life writing naturally, and I don’t need someone to proofread my chats. That’s a habit I am tossing, in general.

Perhaps it is the ADHD that actually helps me focus; that is, perhaps the coping mechanisms built for managing my countless disparate thoughts also work for managing multiple disparate agents? Just thinking out loud.

borski··on The lifesaving secret hidden inside a horseshoe crab's blue blood
Recombinant factor C (rFC) has been available since 2003.

TFA alludes to it: “They have created a lab-made alternative to test medicines, so no crabs are needed.

“It is the exact same protein, it is just made through biotechnology,” Bolden said.

Bolden said scientists at Eli Lilly tested thousands of samples on hundreds of different products and determined the alternative performs the same or better than purified horseshoe crab blood does.

Starting in 2016, Eli Lilly started to switch its testing to the lab-made version. Now 80 percent of it is done using the alternative.

The company plans to entirely eliminate the use of crab blood.”

borski··on Delta flight hit by firework while landing at Midway Airport on Fourth of July
Given that most dogs are adopted from shelters, dog behavior is often a reflection of early upbringing. The current owner can train and teach their dog, but some behaviors and fears set in fairly early on.

Moreover, many dogs are beaten or worse when they’re young, and undoing that fear and trauma is a lifelong (for the dog) struggle.

Thus, dog behavior is far from “strictly a reflection of their [current] owner.”

Page 1 of 34Next →