conradev

The cycle must not be broken https://xkcd.com/2044/

I think all containers share the same netns in a pod. You restrict the pod to only the Wireguard peer IP, and have a (NET_ADMIN) sidecar container create an interface (tun/kernel wg) and update the routing tables for the netns. Then I believe the traffic from the other containers in the pod is tunneled.

Tor does this the right way on Linux. You make a separate user namespace with access only to the WireGuard network adapter and run the program inside of that. You want the kernel involved if you want any sort of guarantee:

https://blog.torproject.org/introducing-oniux-tor-isolation-...

Prompt engineering (communicating with models?) is a foundational skill. Skills, tools, MCPs, etc. are all built on prompts.

My take is that the overlap is strongest with engineering management. If you can learn how to manage a team of human engineers well, that translates to managing a team of agents well.

  The team includes recently retired, Chinese-born former ASML engineers and scientists — prime recruitment targets because they possess sensitive technical knowledge but face fewer professional constraints after leaving the company, the people said.

and

  Once inside, he recognized other former ASML colleagues who were also working under aliases and was instructed to use their fake names at work to maintain secrecy, the person said.

I would very much love that. I like `jq` itself as a standard, even though I don't know how well it maps. Areas where I'd want to use Lite³:

- Microcontrollers. I find myself reaching for https://github.com/siara-cc/sqlite_micro_logger_c/tree/maste... because SQLite is just too big

- Shared memory regions/mapped files. Use it to share state between processes. Could you make mutations across processes/threads lock-free?

- Caching GPU-friendly data (i.e. image cache). I'm not sure if the current API surface/structure is page alignment friendly

That second point is huge – Rkyv does have limited support for in-place mutation, but it is quite limited!

If you added support for running jq natively, that would be very cool. Lite³ brings the B-trees, jq brings the query parser and bytecode, combined, you get SQLite :P

Apple deploys LPDDR5X for the energy efficiency and cost (lower is better), whereas NVIDIA will always prefer GDDR and HBM for performance and cost (higher is better).

This is super cool! I've always liked Rkyv (https://rkyv.org) but it requires Rust which can be a big lift for a small project. I see this supports binary data (`lite3_val_bytes`) which is great!

The determinism depends on the architecture of the model!

Symbolica is working on more deterministic/quicker models: https://www.symbolica.ai

I also wish it was that easy, but compiler determinism is hard, too: https://reproducible-builds.org

I used to hand roll the assembly, but now I delegate that work to my agent, clang. I occasionally override clang or give it hints, but it usually gets it right most of the time.

clang doesn't "understand" the hints because it doesn't "understand" anything, but it knows what to do with them! Just like codex.

  It is thought up to 35 turbines were present on the site of xAI’s existing data center, generating 422MW of power.

That is a few square miles of solar panels, which I don't think is quicker to install than the 35 turbines.

https://www.datacenterdynamics.com/en/news/xai-removes-some-...

I find the granular nature of dependency sharing in NixOS to be really nice. In particular, I like systemd as my hypervisor. With systemd I can still isolate and lock down processes, but they can still, for example, share memory pages of `glibc`. It is certainly less "secure", and with Docker at least you're sharing the same kernel. It's also hard to share resources between Docker containers. Getting 4 Docker containers to use the same instance of Avahi, for example, requires explicit configuration.

Docker containers also don't have a "standard" for where to put binaries (outside of CMD/ENTRYPOINT), how to configure users/uids (many still run as root?), whether to put multiple services in one container or separate containers, where to put user data, etc. NixOS coordinates this centrally like any distro, assigning paths and UIDs and ports.

I have found Nix and NixOS to be able to absorb any amount of complexity I throw at it with grace.

If a Docker image truly is the best way to use a bit of functionality (like Home Assistant), then I will just configure NixOS to run it in podman as a systemd service with host networking.

I have not come across something that I could not package. The trick is that Nix composes functionality in a way that Dockerfiles or docker-compose configs cannot, because it's one language, one system, one abstraction.

The signing is definitely about control, as is all things with Apple, but there are security benefits. It's a pretty standard flow for dev tools to ad-hoc (self) sign binaries on macOS (either shelling out to codesign, or using a cross-platform tool like https://github.com/indygreg/apple-platform-rs). Nix handles that for me, for example.

It makes it easy for tools like Santa or Little Snitch to identify binaries, and gives the kernel/userspace a common language to chat process identity. You can configure similar for Linux: https://www.redhat.com/en/blog/how-use-linux-kernels-integri...

But Apple's system is centralized. It would be nice if you could add your own root keys! They stay pretty close to standard X.509.

my setup is SO deterministic and repeatable that it hurts sometimes

This is my favorite use of CLI AI coding tools: updating my nix config. I can just ask my computer to configure services for me!

and as with most things in Hack Club... it's open source :)

https://github.com/hackclub/hcb/issues/12314

I do not speak for the 'club, but I believe it was resolved: https://news.ycombinator.com/item?id=45292042

Best Buy sells PC parts and accessories nationally in their stores, even though the selection is not great.

I walked into a Central Computers the other day and was flabbergasted. I had never seen a Threadripper PRO or a 10G switch in a store before!

serde is a pull parser and it would take significant modification to convert it into an incremental push parser without blocking a thread.

I would second Recurse Center. I've heard universally great things!

Hack Club builds software, so the students naturally built a banking product to scale their fiscal sponsorship: https://hackclub.com/fiscal-sponsorship/

I was working with Hack Club students on an experimental VPN client (https://github.com/hackclub/burrow) but never got the momentum to finish it. Made some great friends, though! It's a really fantastic organization.

The students have one big global Slack instance. If you're a student and on here, you should also be in there: https://hackclub.com/slack/

Yep: https://en.wikipedia.org/wiki/Monotype_Imaging#Consolidation...

  Fontworks’ team, type inventory, IP, technology, and services will join global type specialist Monotype–Monotype’s first acquisition in Japan.

https://www.monotype.com/company/press-release/fontworks-pla...

My understanding of this design is that you can write the logic separately from the decision to "do I/O immediately" versus "tell me when the I/O is done"

You can write a parser thats outputs a DOM and run it on a stream, or write a parser with a streaming API and run it synchronously on a buffer. You should pick the optimal tool for the situation, but there is no path dependence anymore.

They claim that streaming over WiFi to a single mobile device is 37W:

  Because phones are extremely energy efficient, data transmission accounts for nearly all the electricity consumption when streaming through 4G, especially at higher resolutions (Scenario D). Streaming an hour-long SD video through a phone on WiFi (Scenario C) uses just 0.037 kWh – 170 times less than the estimate from the Shift Project.

They might be folding in wider internet energy usage?

https://www.weforum.org/stories/2020/03/carbon-footprint-net...

Your computer might use more energy displaying the results to you than the server does generating them. Especially in Chrome :)

The server shares resources!

I believe it is MIT-licensed code from three.js: https://github.com/mrdoob/three.js/blob/55b4bbb7ef7e29b214b9...

This is super cool! I didn’t know I was looking for exactly this, but I am

I run Codex in a sandbox locked to the directory it is working in.