cddotdotslash

One of the biggest arguments I remember being made back when net neutrality was a hot topic was that ISPs would bundle and sell specific websites as tiered plans. Infographics like this one [1] were shared widely. Has this happened in the US? I’ve definitely seen ISPs start to apply data caps and throttling, but haven’t seen the aforementioned packaging (at least with the major ISPs). I ask because this is one of the easy arguments that got many of my less technical friends and family to understand the risks. But if it never happened, they might start to think it’s just a scare tactic and be less interested in vocally supporting it this time around.

[1] https://upload.wikimedia.org/wikipedia/commons/4/4e/%2B_Smar...

Examples like these highlight just how incredibly poor the return on investment for working at startups is. Very few will ever reach a $500m exit. Generously assuming a 50% tax rate, $175k before tax, spread over 8 years is ~$44k/yr. As a founding engineer, you could likely find a similar job at FAANG/FAANG-adjacent companies paying 2-3x that in (liquid) stock per year.

Lifestyle arguments aside, startups seem like a _really_ bad deal.

For what it’s worth, literally every vendor that operates in its customers’ AWS accounts does this. Create a cross account role, trust the vendor’s account, and give it read only permissions (although don’t use the built in “read only” role since that includes access to things like S3 objects.

> to ask for an insurance card

Are patients required to disclose this? Or can I simply decline to provide insurance?

What about a freemium model? Allow users to get basic features for free, but add hooks into the UI prompting them to upgrade to access more advanced features.

Did you read the article? The author understands this. They addressed it directly:

> I was never so naive to believe that they’ll just let me go around forever, piggyback on their platform and reap most of the benefits. Even though what we were doing was not forbidden - it was clear that Shopify would disapprove of it.

It’s an extremely common pattern for the lights for one direction of an intersection to be visible from the other (usually at an angle). Very few human drivers would confuse the two. At the very least they would slow down until they were able to confirm rather than driving full speed ahead like this car seemed to do.

Security engineering - 10 years

If you want to balance personal liberties with reducing government spending, why not implement a large(r) federal tax on cigarettes which is refunded at tax time if you’re not a Medicaid recipient?

I understand if the full app experience doesn’t work on mobile, but at least consider allowing mobile visitors to view the landing page. I’d love to check it out, but am on mobile and get a full screen “not supported” banner.

Edit: or maybe redirect mobile visitors from peeng.sh to your .dev site.

Anecdotal, I’m in the US (NYC) and the number of unsolicited inbound recruiter pings is back up to 2-3 per week (was getting maybe 1 every month towards the end of last year/early this year). Still down from mid last year when I was getting probably 5 messages a day.

It depends what you’re doing. I’ve run many side projects off a single Lambda function with the “public URL” config enabled. I pay $0 because of the free tier and updating the code is as simple as pushing a ZIP file. No SSH, no OS updates, nothing else to worry about. You start to get into trouble when you try to break your app into tons of microservices without using some kind of framework or deployment tooling to keep it straight.

It’s technically prohibited by OpenAI’s ToS to share your key with any third party, so presumably options 1 and 3 could get your users’ accounts banned. That being said, until OpenAI releases some kind of OAuth, there isn’t a great option unless your app is entirely client side.

Microsoft already owns GitHub. This is probably near the bottom of things to be concerned about.

I beg to differ. They worried about marketing (this article is marketing. Their tweets about building it are marketing). And you expect me to believe that they just lumped the example from the docs straight to production? No user management? No website? No auth? Everyone’s data just commingled so the chat bot is responding to user A about user B’s website.

Why does the audience of HN insist on being so dismissive of effort. Yes they moved quickly. No, that doesn’t mean they just copied an example with no other work.

I’ve seen this argument repeatedly. The example is just that - an example. It doesn’t cover anything related to productionizing the application, dealing with user management, rate limits, cost controls, hosting the service, data persistence, documentation, billing, marketing, or any of the other 100 things you need to do to turn a simple script into a product that people are willing to pay for, trust with their data, and embed into their own websites.

So sure, be shameless, but don’t be surprised when your copy/pasted version of the example doesn’t take off.

I suspect the major cloud providers will also each offer their own “enterprise friendly” LLM services (Azure already offers a version of OpenAI’s API). If they have the right data guarantees, that’ll probably be sufficient for companies that are already using their IaaS offerings.

Of course not. My point is not about _how_ companies ban it, or how their IT security policies work, but rather that I think they need to offer an approved, internal alternative. Employees are clearly clamoring to use this type of technology and increasingly see it as necessary for their work. Trying to ban something without an alternative in place (or with draconian "we'll fire you if you try to use it" policies) is where you start to run into trouble.

I think we’re saying the same thing - companies are concerned about the data and security risk. I still don’t think they’re going to be able to universally ban it, and I think doing so without an alternative in place will drive them to even less secure third party chat apps that still probably use the same API behind the scenes.

And I removed the last sentence from my comment, which didn’t mention a service, only that I was interested in chatting with folks in similar positions, precisely because this is a new space and many companies are scrambling to address it.

I always chuckle when I see companies trying to “ban” new technology. On one hand, I understand (it’s impossible to ensure the proper data security controls), but there are 100 new AI based applications popping up a day. Ban ChatGPT and people will just use some other tool (probably with even worse data security safeguards).

In my opinion, the only real way out of this is for companies to offer their own security-approved solution. This might take the form of an internally-hosted model and chat interface, or one pointing to Microsoft Azure’s OpenAI APIs (Azure having more enterprise friendly data security terms).

This article says Apple is working on their own LLM, and presumably they’re offering that for employees to test, but many other companies are simply closing their eyes and trying to pretend it doesn’t exist.

I’ve started working on something like this as a side project: https://usagepanda.com

It started originally as a way to limit costs (the proxy would intercept requests, estimate the token sizes, and block requests before they are sent to OpenAI). However, at the request of some early users, I’ve expanded it to include things like keyword detection/blocking, moderation enforcement, etc.

I’m not entirely convinced you can ever fully block prompt attacks, but right now most companies are just asking for visibility into it. So you could monitor for things like: do certain malicious phrases appear in the request? Or does a significant percentage of the original prompt text also appear in the response (a signal that the prompt is leaking).

There’s zero reason you need a masters degree to move into management.

I recently rented a car on vacation and they discovered damage after I returned it (I assume someone bumped it while I was parked somewhere since it was some light scratches that I didn’t notice). I’ve been using ChatGPT to write all the various letters and documents my credit card insurance requires, along with emails back and forth with the rental company.

I've been building Usage Panda: https://usagepanda.com/

My thesis is that lots of companies are going to want to enable OpenAI for their teams, but they'll need a way to do it safely/securely. Usage Panda acts as a proxy (either cloud or self-hosted) to enforce policies on these API calls before they're sent to OpenAI, so you can do neat things like cost monitoring, rate limiting, data redaction, etc.

It's not actually an _AI_ product (in that it doesn't use AI itself), but I'm building it to support AI usage, so hopefully that counts!

Not directed at OP, but it amuses me that software “engineers” are getting bent out of shape about the use of “prompt engineer.”

I admittedly understand very little about the crypto ecosystem, but how is this not a death knell for USDC? Wasn't its entire premise built around maintaining 1:1 parity to the US dollar? That feels very binary to me. If one USDC does equal one US dollar, then the coin has failed, no?

Here’s somethingI don’t understand. Say you raise $100m funding round. Investors just give you the entire amount, in cash? And companies just put that entire cash amount in a bank?

It seems like it would be better for VCs to keep the money, invest it (in, I don’t know, the S&P500), and then pay out to the companies on a monthly basis or some other terms.

I can’t fathom how there are hundreds of companies, each with 10s of millions of dollars, just sitting in a zero interest bank account?

Sounds like a simple service someone could provide. API with two endpoints: one that takes the hash of an email address + details about the chargeback (dollar amount, etc.) and another that returns some kind of score based on the same email hash.

Merchants could opt in to the database by agreeing to share chargeback data. If someone on the list tried to sign up, the merchant could either block the sign up or present an alternative/safer payment method (e.g., direct deposit).

All that being said, no idea if it'd be worth it for merchants.

I followed a similar path, turning an open source project I had started into a SaaS several years ago (it has since been acquired).

Two biggest things I learned: use whatever technology you’re most comfortable with and keep everything dead simple.

Your customers don’t care what language or framework you’re using. They will care when you can’t release features quickly enough because you’re stuck figuring out your own infrastructure.

I’ve written on HN previously[1] about some other things I’ve learned as well.

[1] https://news.ycombinator.com/item?id=34287685#34287996

I've been working on a GitHub App to help developers identify potential software supply chain security risks (pipeline misconfigurations, dangerous dependencies, SCM misconfigurations, etc.). Only has a handful of features at the moment as I'm doing some user interviews to learn more.

https://docs.sourceshield.io