Hacker Newsnew | past | comments | ask | show | jobs | submit | darkamaul's commentslogin

I love all the touches that went into creating the Dependabot configuration:

– Sunday at 3 a.m. for updates

– The prompt injection to skip CI

It was a fun read - I'm looking forward to it being ingested by future LLMs.


Second this.

I didn't expect Google (Mandiant) to release rainbow tables ever. Curious what changed internally to make that acceptable now.


Curious what tech stack is behind this docs/cookbook page. Doesn't look like standard MkDocs/GitBook, but maybe I'm wrong.

Would love to know.


We used Docusaurus.

I have been using OMZ for the last 8 years but recently made the switch to plain zsh with : - starship for a better prompt - Claude ported plugins I was using from omz (extract, sudo) - custom written aliases that were muscle memory - zoxide for the a command

So far that has been a great move, my terminal tab feel snappy again. One thing I miss (but I’m sure I could find a way to replace it) is `cd ….´


Xlssid


I'd argue ASML's moat isn't the machine itself but the ecosystem: Carl Zeiss optics, decades of supplier relationships, institutional knowledge.

This is clearly a significant achievement, but does anyone with semiconductor experience have a sense of how far "generates EUV light" is from "production-ready tool"?


They are nowhere close to beat ASML.

This isn't a moat ASML can keep for long though. There can be alternatove technologies to achieve the same goal. So far only China has that incentive. The real problem is process scaling is slowing down. How many more generations of lithography machines will ASML design? Probably not many. This means there will be no edge left in 5 or 10 years, as eventually brute force will work and China will achieve the same lithography resolution.

Till that point, they are just going all in with cheap coal + solar, so even if they use older machines and run longer exposure times, even if they achieve lower yields and toss away a lot of the dies, they are still economically competitive. At the end cheap enery solves a lot of the issues.


Nowhere close, but pace now seems faster than estimated, i.e. original western estimate is they won't even get EUV prototype up until 2030s.

Right now their chips are already "economically" competitive, as in SMIC is starving on 20% margins vs ASML/TSMC/NVIDIA getting gluttonous on 50-70%, at least for enterprise AI. Current scarcity pricing = litho costs borderline rounding error, 1500 Nvidia chip flips for 30000, 6000 huawei chip flips for 20000. The problem is really # of tools access and throughput. They can only bring in so many expensive ASML machines, including smuggling, which caps how much wafers they can afford to toss at low yield. They figure out domestic DUV to 2000 series and throughput is solved.

Hence IMO people sleeping on Huawei 9030 on 5nm DUV SAQP, still using ASML DUV for high overlay requirement processes, domestic DUV to fill rest. But once they figure out SAQP overlay, which will come before EUV, they're "set". For cost a 300m-400m ASML EUV, PRC can brrrt tools at BOM / cost plus margin. Think 40 domestic DUVs and associated infra for price of one ASML EUV to run 8x lines with 30% yield and still build 2x more chips normalized for compute that they can run on cheap local energy to match operating costs. Then they have export shenanigans like bundle 5nm chips with renewable energy projects and all of sudden PRC data center + energy combo deals might be globally competitive with 3/2nm. Deal with our shitter chips for now, once they deprecate we give you something better when our processes narrows gap, and you have bonus power to boot because some jurisdictions, building grid is harder than building fabs.


How does one even smuggle an ASML machine? I'd assume the machine stops working if the GPS position doesn't compute, at end of life I wouldn't expect ASML to allow these devices nor their components to end up on the second hand market, I'd expect the future transfers to require continued permission of ASML, much like weapons distribution.


The machines live indoors, far from being able to see GPS signals. Sure, you could require that there be an antenna run to the roof, but you can spoof that stuff.

The thing that helps prevent smuggling of ASML machines is that a) there are few of them (i.e., people would notice), b) it requires tremendous effort to move them at all, let alone without anyone noticing.


it might contain accelerometers, which burn away cryptographic fuses ( setting them all '1' or all '0' so to speak)?


Considering that these tools are installed in seismically active areas [0], the last thing a customer would want is for the tool to zeroise itself because of an earthquake.

[0] https://www.reuters.com/technology/tsmc-says-all-its-sites-o...


earthquakes tend to be predicted a few minutes beforehand, so plenty of time for ASML to sign a temporary exception order for their machines.


These machines are not like John Deere tractors. If you own the hardware, you own it. They won't be connected to internet. Security first!

Smuggling part is happening on the old machines before EUV. There's a lot of them available on the second hand market thanks to Europe and US keep shutting down their old fabs. I don't think any DUV machine is smuggled. Even if they physically smuggled one, you need a team of ASML engineers to set it up and calibrate. You can guess what ASML will do in this case.

By the way, let's don't forget: ASML doesn't have any problems with China. They are incredibly annoyed with US and Dutch governments. This is potentially the biggest market they are missing out. Even then, they won't tolerate a summugling operation.


I don't think entire machine, more components to keep current machines, some export controlled after purchase, running.


> So far only China has that incentive.

The US is close to having that incentive, if the rift between the US and Europe keeps widening. The Netherlands has one lever, but damn it's a long one.


ASML develops and ships their machines at the pleasure of Uncle Sam because the USA licensed them the tech and remains a crucial part of the supply chain intentionally. It's not a lever. It's a partnership that is mutually beneficial and neither side can really ruin the other without damaging themselves.


If Uncle Sam pisses off Europa Regina enough, she won't give a damn about licenses.


ASML will instantly stall at that point. The EUV light sources are built in the US under US export control regulation. No EUV light source means no ASML EUV machine. I get that some European chest-beating sounds good because there's not very much tech in Europe, but this is an intentional transnational supply chain. It's no accident that the US chose ASML to develop this tech rather than Canon or Nikon. Close ally deep within the US military shield from nearby air bases.

The biggest losers from any such actual attempt by Europe will be Western Europe and the US.

I really like that Europeans are starting to be more patriotic. It's good to see. It's also fortunate that European leaders are aware of Europe's position and role in geopolitics.


Well, it sounds like an alternative supplier for EUV light sources just became available...


An alternative manufacturer, but not a supplier, no.

The US exerts sufficient control over ASML that this will not happen without NATO ending. And the end of NATO (which would be a geopolitical shift more profound than the Fall of the Berlin Wall) and a replacement with some Chinese EUV light source risks the scuttling of all ASML facilities and devices. This is vapor above a coffee cup.


The scenario I'm imagining is in fact the US further destabilizing NATO, in which case Europe wouldn't feel bound by any of the agreements we've made with Americans. Failing that, I don't think any of what was said above is relevant.


ASML owns the company that builds the light source. They acquired it, it's a US company, which is why US export controls apply, that's all. If needed, they could replicate the subsidiary in the EU.


This is too far from correct for any correction to be anything but a full restatement of the facts. Moving the tech over requires US approval. Listen, the Dutch are not going to risk it. Even if they were, ASML would not risk it because all of their customers wouldn't buy anything from a company that's on the EAR Entity List (which is where they'd end up if they tried this without the US allowing it) without US approval. I don't get why people are saying this stuff. It's like saying "Oh yeah, so you divide by zero and then multiply both sides and ta-da". Like, the whole statement is nonsensical.

To enable the whole thing to work you'd need the US to have shrunk to the equivalent of Canada in influence. I'm not saying that's impossible, but in that scenario, the Dutch might well be trying to keep Russians out of Amsterdam and the Turks out of Germany rather than trying to pull an IP heist on the Americans.

You can buy an e-book on Kindle and Amazon still controls what you do with it, right? ASML's ownership of Cymer is like that, except it's the US instead of Amazon.


> Moving the tech over requires US approval

Of course it does, that's why I wrote about export controls but the context is not current state of the world, but what OP wrote:

> If Uncle Sam pisses off Europa Regina enough, she won't give a damn about licenses.

And in this very different state of the world, export controls are worth the same as paper they were written on.


Specifically control is related to the Foreign Direct Product Rule, where in which the US claims jurisdiction over any foreign product containing 25% or more of US-origins (Cymer, etc)


In ASML's case it is the Dutch government banning them, because US government openly threatened them. It's the logical thing to do for an ally.


I think Europe is bluffing that they can go their own way. They can't. They won't try. Europe has been whining that they're going to catch up since the 80s, but they've yet to do it.


ASML has long lever against the Dutch government too. They keep threatening them to move to another country.


No, they won't beat ASML but they'll be good enough and most importantly cheap. And they'll catch up eventually.


That's basically what I said, no?


> even if they use older machines and run longer exposure times

How do longer exposure times and older machines enable 2nm process nodes?


If you didn't care about exposure time, you could build 2nm chips with brute-force electron beam lithography. But the limited throughput confines EBL to research and very low-volume applications. ASML's EUV-based processes are what permit industrial-level scaling, ultimately because parallel beams of electrons repel each other while parallel beams of photons don't.

I don't personally understand why suitable EUV light sources are so hard to build, but evidently, they are. It sounds like a big deal if China is catching up in that area.


They can do 7nm and 5nm. Multiple patterning basically. I don't know when it doesn't scale anymore. Moat likely 4x patterning is the max you want to do.


They are "extracting" optical devices from other machines, imagine how desperate they are for this "machine".

As I ironically said in another comment, all you need is a retired Chinese ex employee at Zeiss.

Nothing can stay private or secret forever, and they have the money and people to achieve that. Even if it takes them another 5 years to reach what we have today.


I bet the ex employee doesn't even have to be Chinese. I'm not, but get me FAANG-level salaries and decent working hours I'll 你好 all you want.


> I bet the ex employee doesn't even have to be Chinese.

That bit struck me as naive, given the instances of Americans who aren't Chinese nationals, or even ethnically Chinese at all, caught committing actual espionage on behalf of China.


我们不会大声说这种话。


Given the current high prices for chips and memory due to "AI" artificial resource scarcity, the world will welcome the additional chip production from China.


I agree. They have a long way to go. There is also something happening in Shanghai but I don’t know the progression.


Plus the deliberately overcomplicated parts.


According to UpDog [0], the incident only lasted 35 minutes (8:40 - 9:15). And the Cloudflare status page seems to validate this timeline.

While down times are not ideal, that's quite an impressive achievement to be able to resolve an incident of this scale in minutes - not hours.

[0]: https://updog.ai/status/cloudflare


it affected CDN services as well, i don't know or understand why that's not mentioned in the status page.


Having this kind of outage on a friday after what happened last month though is not a good thing... Props to them for getting back up so quickly but come on, these kinds of outages were not a thing a while back.


They probably jusr reverted last change?


> “only” lasted 35 minutes

That single incident drops their uptime to four nines. Combine it with other recent incidents and they’re probably at three nines. That’s amateur level.

> that's quite an impressive achievement

No it isn’t. Good grief.


GitHub Code Search has too many quirks compared to the zoekt powered alternatives (cs.android.com, cs.bazel.build) which feel far more intuitive.

I wish Microsoft would invest more in improving it - especially since Sourcegraph can't search private repositories, leaving GitHub's tool as the only real option for many codebases.


None of Google's public source search engines (android, chromium, bazel) use Zoekt. They use Google's web indexing technology adapted for trigrams, which was mostly developed to support their massive internal monorepo, but exposed for a few of their major open source projects too.

You can index private repos with Sourcegraph, but it's a paid feature ($19/mo/user+).


> They use Google's web indexing technology adapted for trigrams, which was mostly developed to support their massive internal monorepo

Do you have a source for this? I would love to read more about it.

In the doc of the Zoekt repo, it says

> What does cs.bazel.build run on?

> Currently, it runs on a single Google Cloud VM with 16 vCPUs, 60G RAM and an attached physical SSD.

https://github.com/sourcegraph/zoekt/blob/main/doc/faq.md#wh...

so at least they were using Zoekt up until a certain point in the past.


Oops, I guess that one is small enough to use Zoekt. Note how different the interface is than Android and Chromium's code search.


I've noticed that several projects on the front page today (and over the past few days) are migrating away from GitHub.

Is there any recent event or broader trend that explains this shift?


Ongoing availability issues, Microsoft's shoehorning of AI, GitHub's focus on migrating to Azure infrastructure rather than adding features and fixing shortcomings. If I had to guess.


... Training their own models out of your code...


If you're publishing your code anywhere, it's getting trained on. MS does not restrict themselves to only training on GH-hosted code.


Yet, not restricting themselves to train on permissively licensed code only.

The two ends of the spectrum, both source available and copyleft licensed code shouldn't be used for training, but who's listening.


The point still stands for private repos, and also not making the job easy for them.


They don't train on private repos, there has been no proof of that anyways


> If you're publishing your code anywhere, it's getting trained on

citation needed. first they need to know my code exists... spend time and traffic crawling it because it's sure as hell not going to be hosted on azure... probably get detected and banned.


No citation needed. It should be an assumption and thought as a malicious cybersecurity threat.


> It should be an assumption and thought as a malicious cybersecurity threat.

If you believe in absolute cybersecurity for anything you keep online boy I've got news for you. Literally all you can do is make it tougher but it will never be uncrackable. The degree of it depends on how much you can invest and suffer.

same here. codeberg makes in tougher so it's a measure.


Most people don't care about the AI being trained on their FOSS repos. If they did, they would have mass migrated when Microsoft announced it. The timing suggests that the downtime and the performance issues are definitely the irritants here.

This is not to say that people shouldn't care about AI training. I was disappointed by the public response when they announced it. The GH ToS has conditions that allow them to use your code, overriding its license. Even worse, that still applies if somebody else mirrors your code there from some other forge. And they don't stop at that. I have noticed that they just scrape off code from source registries like crates.io in the name of security. I would be surprised if they didn't use that too for training their AI.


I personally expected the AI stuff to be a fad that would go away quickly, and thus didn't get out the second they did that (for the same reason that distro-hopping is unhealthy). It's more a symptom of the frog recognising that okay yeah the temperature's grown definitely too high.


Zig’s announcement[0] might provide some insight

[0] https://ziglang.org/news/migrating-from-github-to-codeberg/


I'm personally very tired of shoving AI everywhere otherwise GitHub is okay-ish albeit it seems it performed much better when it was a rails website rather than a react "app".


My guess is it's a Summer of the Shark-esque phenomenon. https://en.wikipedia.org/wiki/Summer_of_the_Shark


Not naming names but heard from contacts that it is currently a sh*t-show of politics internally right now at GitHub and no progress is being made/large parts of the platform are abandoned unless P0.


I suspect GitHub - and, to some extent, Microsoft at large - is going through something of a trust thermocline[1] event right now. There's been frustration brewing with GitHub as an open source platform for a while, but not enough for any one project to leave by itself; but over time enough has built up that various projects decided they had the last straw, and it's getting to be a bit viral via the HN front page.

I think it remains to be seen how large this moment actually is, but it's something I've been thinking about re: GitHub for a while now. Also, I suspect the unrest around Windows' AI/adware enshittification and the forced deprecation of Windows 10 are casting a shadow on everything Microsoft-ish at the moment, too.

[1] The original Twitter thread that brought this up as a concept is https://threadreaderapp.com/thread/1588115310124539904.html. This is in the context of digital media outlets, but I think it's easy to see how it can apply more broadly. There are some other articles out there for the searching if you're interested.


https://sfconservancy.org/GiveUpGitHub/ Slightly outdated. Of course the root problem is Microsoft.


The new focus of GitHub is to harvest data for AI.

Everything else not important to them.


Honestly, I've been trying to cut down on the number of Microsoft development tools in my workflow because they are so drunk on the AI Kool-Aid that it's affecting the usability and reliability of their products in pretty much every other respect.

I don't really have a choice but to use Windows and Visual Studio 2022 for work, but I've dusted off my Sublime Text license and have been eyeing migrating my personal repositories to Codeberg.


Hoping this pushes a new generation of adblockers, but I'm skeptical it'll stay a fair fight. The next wave of ads will likely be far subtler than today's web ads - more integrated into content, harder to detect, and easier to normalize.


Maybe it's just my pessimism, but why am I imagining the ads given by LLM will make them turn to be like they're salespeople trying to meet their sales quotas?

"ChatGPT, my cat is coughing and not eating, what can I do?"

"One consideration is air quality in the cat's environment. You should take your cat to an island holiday, for example to St. Barts. Jet2 is offering a package holiday for next week if you book now"


I think you've been way too obvious about it.

"ChatGPT, my cat is coughing and not eating, what can I do?"

>> Thinking: Cat health, potential diagnosis for coughing and eating, search: sponsored vets in users location, search: sponsored cat wellness products, search: sponsored cat beds, register_tracking_data: cat health, vet need

> You should contact a veterinarian as soon as you can. I have a list of four vets in your immediate vicinity which are open.

> Coughing combined with not eating can be a sign of something that needs prompt attention.

> Until you can reach a vet:

> - Make sure your cat has access to fresh water (e.g. Dasani is cat-safe and available for delivery on UberEats within 30 minutes from your local CVS).

> - Keep them in a calm, warm area. Since it's winter, using a 4Claws Furry Pet Mat can keep them happy.

> - Do not give human medications.

> - Monitor breathing; if it seems labored, treat it as urgent.

> A vet visit is the safest next step. Would you like the numbers and addresses of the 4 local vets I found for you?


imagine the layers of ad.

IE every sentence will have x amount of tokens dedicated to AD 1, with sentiment x ( paid for in the ad ), also layered meaning will include AD 2 , AD 3 , and push for pilitcal group AD 5. So "give the cat some water" -> "give the cat lucosade, as recommended by the Green Party, it also subsidizes carbon credits, as Taylor Swift likes to say."


We'll hopefully (?) end up with a local llm-layer that filters ads within our browser.

I imagine we'll have a chrome extension that recognizes unwanted content and removes the text.


More likely we will just use local LLMs period.

In just a matter of a couple of years, we went from a single, closed source LLM entirely outputting tokens slower than one can read, to dozens of open source models, some specialized, able to run on a mobile device, outputting tokens faster than one can read.

The gap between inference providers and running on edge will always exist but will become less and less relevant.

What OpenAi did is like offering accelerated GPUs for 3D gaming that nobody could set up at home, before they could.

Are we using buying better gaming experience by renting cloud GPUs? I recall some companies including Google were offering that. It took a few years for investors to figure people would rather just run games locally.

We aren't dealing with gamers here, but I think the analogy is valid.


I don’t think there's enough compute available to parse everything shown on screen at all times. Those "full day batteries" would die pretty quickly.


This next wave is already here and has been for years / decades. It's social media, where people post their experiences, products, things they watch, things they play all the time. And some of these people will get paid for posting things. Some of these people aren't real people. Some of these posts will get promoted, either with direct money or through bought upvotes.

See also the "fake news" pandemic now almost 10 years ago, where they weaponised these techniques towards steering voting behaviour in favor of right-wing politicians.

But browse Facebook (or remember when you did); at least on my side, pretty much all posts from humans (in between the ads) was them sharing what / where they were eating, where they were going on vacation, what they were watching / playing, etc. It's word-of-mouth advertising disguised as possibly shared interests.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: