davidfiala · HackerTrans

davidfiala

32 karmajoined 4년 전

YC W23: logital.ai // teclada.com

https://www.linkedin.com/in/davidfiala/

Submissions

cerebras: 450 tokens/sec llama 3.1 70B

theregister.com

7 pointsby davidfiala2년 전2 comments

New way to hide backdoors in github: "reviewed your report: not a security risk"

youtube.com

12 pointsby davidfiala2년 전4 comments

comments

16일 전discuss

Attestation of any type: A double edged sword, where you are guaranteed to lose freedom. Attestation entrenches, empowers, and enriches other entities that aren't you.

Ironic how this post got upvoted in parallel to polar opposite in the #1 slot: "John Deere owners will get the right to repair equipment under FTC settlement" https://news.ycombinator.com/item?id=48838876

Engineers may debate about what-about-isms of vulnerabilities and counterexamples of TPM failures, but that misses the point: We should be debating about where society will be when devices you paid for serve other masters.

Probably we should just write/vibe/demand better software. Otherwise we're going to end up with a law demanding TPMs that watch more than just your firmware...

6개월 전discuss

Missing Option 3) hardware and software continue to evolve and AI becomes cost efficient at the same price and eventually even lower

8개월 전discuss

Very nice. Thanks for making it clean and simple to use. I'm curious, only if you're willing to share, how you check so many domains availability automatically? Is there any potential rate limit problems behind the scenes?

One challenge I've always seen with similar tools is that the AI always wants to generate MultiWordsTogether domains, even when selecting that you want only creative short ones like "uber". Maybe this is something that a prompt change could help solve. But I'm pretty certain that LLMs today are just bad at type of single word creativity in their default state.

Bug report: when I click on the hamburger menu and switch to another item on your site, I get into an infinite loop of being prompted to sign into Google.

12개월 전discuss

SPAs are not about view transitions. TFA implies that fancy transition is important between pages (wrong!) and blames a "CMO" or "brand manager" rather than challenging their own preconceptions and exploring the value an SPA does add:

- excellent frameworks for client side logic (interactivity) - separation of concerns (presentation logic vs. backend) - improved DevEx => inc. speed of development => happiness for all

The sad thing is that an article like this will get plenty of eyeballs due to comments like my own adding to the algo, but it should have never made it above the fold.

I'd love to see more examples in a portfolio or catalogue page. I think it would help me more clearly see what is possible than just the links above. Or at the very least, having them all together on one page without having to open the design chat URL for each to see the examples would be nice.

I'm glad to see you working on this. It's an incredibly difficult and important space!

Assuming you have a desktop or VM that is always on, then using vs code or cursor with the remote SSH and dev containers extensions installed is great. The extensions operate on top of each other transparently.

A lost or interrupted internet connection is not a big deal. Both IDEs come back right where you left off by just hitting a reload button when you come back.

They also have some black magic (which I recommend against trusting) that will bring your terminal back to a similar state to where it was when you left off. I do not recommend the built-in terminal in either IDE though, but it is there in a pinch. For long-running tasks, if you like SSH, then tmux solves your problem.

I mean, the site is just incredibly beautiful. Good job. I want to go on vacation wherever the made-up end-frame is with the lake on the bottom.

I had to show it to a friend who said they must have hired a frontend engineer yelling, "I've wanted to do this my entire career, and you cannot stop me."

It is important for readers to be aware that the specs compared are not useful today.

Only the latest greated 50x NVIDIA gpus will do DP 2.1 (everything else is DP 1.4). And likewise, even your best monitors are unlikely to support DP 2.1 today.

HDMI 2.x is supported by a wider(est) array of available GPUs and monitors, and thus not only wins out, but is literally the only way to unlock the resolutions and refresh rates in today's situations.

Absolutely excellent!

Very nice!

Regarding the localness, are you optimizing or targeting users that prefer only local inference? The part about API keys at the end makes me wonder if there's any practical difference outside of lower local resource requirements and access to private models on the clound.

Do you recommend or force that people use any specific languages or frameworks that dyad is optimized to render or iterate on locally?

This is great news.

I love thinking about exploit scenarios that remain.

Very niche, but attackers on a LAN or in the path to cloudflare's edge servers probably have a small window to still exploit this.

In my case, I have about 25 millis before the RST packet arrives from CF:

ip=$(getent ahosts api.cloudflare.com | awk '$1 ~ /^[0-9.]+$/ { print $1; exit }') && time bash -c "exec 3<>/dev/tcp/$ip/80"

(Long command because I wanted to separate the DNS resolution time from the time it takes to send a SYN and then get the RST)

An attacker observing network traffic for a SYN could spoof a single ACK and then quickly capture the Request HTTP headers including the auth payload. Often that fits in the first packet.

Another niche idea/risk: TCP Fast Open might also provide an avenue for the HTTP data to get sent before the CF's RST packet is sent, too. I imagine TFO would apply because any connection (even an https one) would have established TFO with api.cloudflare.com, and then one single accidental hit to http instead of https may include payload regardless of the RST? Hmm.

I replied to cold outreach from designers. To vet, I took calls to see their actual portfolio (actual prior work in Figma, for instance), asked about their processes, areas of strength/weakness, types of work (illustrations only? css help? slides? products or only landing pages? which types of target audiences they've had?), etc.

Might be useful to comment on what your budget is. Having an external design team that knows you and can work fast when there's a crunch is very useful as it removes the latency inherent with one-off task based platforms. Plus, you get a consistent level of quality.

If you don't have enough work to keep designers busy on a day to day basis, then it may not be worth it to get a long contract. On the other hand, things often take longer than you expect to iterate and refine.

2년 전discuss

Might be worth explicitly stating popular/known datapoints you were unable to include or evaluate yet.

For example, the fastest inference provider by multiples as of this writing, Cerebras, is missing. It's popular, so I'm surprised it was missed: https://news.ycombinator.com/item?id=42178761 and makes me wonder if other evaluations are missing.

See also a similar (commercial AFAIK) project: https://artificialanalysis.ai/

2년 전discuss

Imagine increasing the quality and FPS of those AI-generated minecraft clones and experiencing even more high-quality, realtime AI-generated gameplay

(yeah, I know they are doing textual tokens. but just sayin..)

edit: context is https://oasisaiminecraft.com/

2년 전discuss

  > Your manager doesn’t promote you?
  > No, managers at Google can’t promote their direct reports. 
  They don’t even get a vote.
  > Instead, promotion decisions come from small committees of upper-level software engineers and managers who have never heard of you until the day they decide on your promotion.

AIUI, nowadays in 2022+ the manager gets the only vote.

2년 전discuss

Exercise extreme caution.

Having your security strategy rely on quirky behaviors of an implementation detail which might change is incredibly dangerous.

2년 전discuss

- 1,800tps on llama 3.1 8B

- 450tps on llama 3.1 70B

free chat interface is at: https://inference.cerebras.ai (requires login)

2년 전discuss

Didn't see it :) you nailed it!

2년 전discuss

Ideally TFA would have also explained why some requests do go through without a preflight. What's called a 'simple' request is the explanation behind TFA's whole premise.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl...

These days, pretty much everything requires a non-simple request in order to invoke an action, regardless of whether the client can read the result.

Agree'd in spirit though that CORS is annoying to use, and it's always worth consulting the manual.

2년 전discuss

It depends on including things like headers and other non-approved changes to the request. Content-Type is one of them, but even it has some whitelisted options.

Read about 'simple' requests to see what you can and cannot do before a preflight is required: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simpl...