1,289 karma · joined February 18, 2011
I guess that’s the “not depending on books alone” part of your comment. It feels like I’ve gained some really important life experience, but I just haven’t fully processed it or been able to make sense of it. Funny enough, I’m making more sense of it with time and with comments like the ones here.
Thank you for your comment!
Context: I just broke up with my girlfriend a few days ago because we would get into arguments regularly around topics that didn’t seem surpassable (values, negative feedback loop insecurity types, etc.) and would leave both of us drained. I just didn’t want that amount of anxiety in my life. I 100% understand that some people are totally cool with it though and don’t have an issue at all.
1-20 people - password manager (bitwarden, 1pass, etc.) 20-30+ people - SSO
50+ people - start assigning real roles to your SSO schema
1-5 services - secrets in CircleCI and password manager is good enough.
5+ instances - use a secrets manager like Vault.
10+ instances - start using a secrets manager locally as well for dev. Start to consider using well scoped IAM policies for each of your services and team members.
15+ instances - start to think about adding additional zero trust boundaries.
Of course, this is very rough. Depending on your regulatory/compliance requirements and how much revenue you’re bringing in and from who, you might have to do this stuff sooner. In general, it should go:
1. Centralize secrets even if you can’t easily revoke people (password manager).
2. Make things easily revocable and centralized (sso).
3. Make roles and access finer grain (RBAC).
4. ^ with automation between all of these steps where it makes sense.
Something I would warn anyone of is building your own auth/secrets core tooling. This stuff is incredibly complex because of the edge cases and it’s just not worth the risk you take on by saving money unless you have a really good core business reason to roll your own. It’s also dangerous to prematurely optimize and pay the SSO tax too early. You will find that a lot of engineers appeal to emotion when it comes to risk. Something extremely helpful is going through and actually assigning a security risk score for all your systems. This might be tedious, but it brings a lot of clarity to the conversation of “what do we want to build when? What risk can we take on at any given stage?”
It takes a ton of effort and courage to have hope in a situation like that. Because you will have to believe something is possible that you have no indication of being possible based on prior experience.
Or you will have to change your outlook to not care about massive financial success as much. But that’s not easy either since that requires a world view and possibly a values shift. Very very hard.
And yeah if I were stuck in that spot, I would feel cursed too and like the higher forces are fucked. It’s totally natural. I really hope for the best! I know you will be good in the end, but I’m sure that’s the last thing you really want to hear since it’s invalidating of how you’re feeling.
I think, when you’re very smart, you are just many steps ahead of the average person in pattern recognition. You can literally store more information and pattern match against it, so you’re going to pattern match up the power hierarchy and think about things that have a negative impact on you that you can never directly affect without traversing up the hierarchy. If most people here (not saying you specifically) would instead just focus on “what is the biggest problem in my life that I have complete control over?”, I think they’d find that focusing on the greater powers that be has little practical consequence since they’re just not at the level where they can exert influence over those powers. There is almost certainly a path to local maxima, and from there, a greater and greater maxima.
I wish I could address your question, but I don’t think there is “fragility” in how Linux does random writing. It’s extremely durable. MacOS (and therefore Darwin) has some pretty awesome optimizations by owning both the hardware and software, but I don’t know if random writes on Mac “succeed” more often than on Linux. It’s also a bit nonsensical since the hardware really matters when we’re talking about write durability.
* if an image doesn’t have alt text
* you need to be read the page
* you need to be described what’s happening in a video
A model built into the OS or browser seems like a no-brainer.
Early on when we were just starting out (context as a founder), I used to think that the only types of people who would take on this kind of risk were young 20-something’s who had time and space and no significant other. Then we hired 2 early engineers in succession who were older.
One was just made for startups. He could never work for a large company, and he was ok with the risk and lower pay because it was still quite high relative to his cost of living in Europe.
The other already had kids who were older and independent. He always wanted to take a swing at a “Silicon Valley” startup, and he just cared deeply about that experience and could do so without having to worry about his kids financially relying on him.
They were 2 of the best engineers we had ever hired and stuck with us through thick and thin from a team of < 5 engineers through us scaling to 80+. When we got bigger, one left because we were once again too big for him (process, minor politics popping up, spending more and more time teaching newcomers how to own and operate a bigger codebase safely, etc.). The other left because of similar reasons but at a later scale.
I started the journey starry-eyed/overly-optimistic in both directions. Hiring people early on who obviously did not have the risk tolerance or an understanding of how much work was needed early. Holding on to people for too long who weren’t enjoying the new environment. Now I’m much more even about this - there is a right place and time based on what the individual wants, and being open and honest and kind about it is always the best path. Equity is simply a lever to compensate risk, but the appetite to take on the right amount of risk is the most important thing given the company’s scale.
> https://github.com/karpathy/nanoGPT/blob/master/model.py#L45
Karpathy's nanoGPT calling flash attention by checking if torch.nn.functional.scaled_dot_product_attention exists
> https://pytorch.org/docs/stable/generated/torch.nn.functiona...
Looking at the docs, in reality, most of the time you want this to call out to FA2 which optimizes the kernals on the device to split ops on the Softmax of the triangular matrix as well as reduce moving unnecessary batches of floating point numbers back and forth from the GPU to the CPU.
> https://arxiv.org/pdf/2307.08691
The paper for FA2 almost entirely considers itself through the hardware it's running on.
So they basically just couldn’t come up with a solution when trying to balance the budget. Definition of death by committee, which is a representation of the will of the people.
How can we do this better? This feels so important, yet it feels impossible if this is the outcome of telling our politicians they need to respect a budget.