skybrian's recent activity

  1. Comment on Bug blindness in ~tech

    skybrian
    Link
    From the article: [...] [...]

    From the article:

    Because I notice these kinds of things, I've had multiple jobs where directors/VPs/execs/etc. sometimes ask me to evaluate something when they want an actual opinion from someone who is relatively likely to notice issues (and fix them or drive fixes for them if necessary). Sometimes I won't find any issues (there are likely issues that just aren't the kind I notice). More often, I find issues that fall somewhere from "mild" to "moderate". And, sometimes, the issues are severe, to the point where one might even say the thing actually doesn't work.

    I find this last category a bit mysterious, as when I look up discussions on how the thing got into this state, there's usually a stream of internal comments indicating that the thing is great, it works well, etc., but when I open up the thing and try it, it's in a state where the thing only works if you do quite a few non-intuitive workarounds. More likely than not, not only would a normal user not be able to use the thing, they'd have such a hilariously/infuriatingly bad experience that they'd tell their friends.

    [...]

    If I think about analogous blind spots I've had, one that jumps out at me is from when I was a little kid and a friend of mine used my computer. For this story to make sense, you have to know that this was in the mechanical mouse era. Over time, detritus would get stuck to your mouse ball and cause it to track erratically unless you cleaned it out.

    When my friend tried to use my computer he found it impossible to use the mouse because mouse pointer movement seemed almost random. When I sat down at the computer again and used the mouse I didn't have any problem using it at all, but on looking at what I was doing with my hand to smoothly move the pointer in a straight line, I was violently throwing my hand all over the place. I realized I must've adjusted to the detritus on the mouse ball over time as it accumulated and I was somehow compensating for the mouse's extremely erratic tracking by making countervailing erratic movements3. I thought it was pretty amazing that I could not notice that I was doing this and I always wonder if I'm doing some equivalent thing today.

    I sometimes think about all of the mitigations I've developed to work around bugs. For example, when opening a new Google Doc, I used to immediately put the title I wanted into the doc. At some point, maybe ten years ago or so, Google Docs added some kind of delay such that the typing you do into the title box right after you open the doc gets overwritten, so I now have this habit where, after opening a Google Doc, I do something else and then I change the title. Over time, as Google Docs has had more and more features added, I've developed a series of habits that avoid all sorts of pitfalls (such as trying to search at the "wrong" time and getting the useless native browser search instead of the Google Docs search).

    My feeling is that a large fraction of computer literacy and software literacy is developing a large library of these habits that you just do at a non-conscious level. These are often quite specific to the situation, such as a habit I developed when I worked at Microsoft of flipping my laptop's WiFi switch to off before logging in (which I noticed other people doing as well). This was because there was some service, which would often fail your login with "There are currently no logon servers available to service the logon request”. But if that service couldn't connect at all, the check would be bypassed and you could just log in.

    [...]

    On the flip side, a large part of making an app easy for people to use seems to mean making weird habits like these unnecessary. Although this sounds like it should be easy to do, from having seen people try to give feedback about this kind of thing, the reflexive reaction of most developers seems to be "huh? It's easy to do X, just do [complex sequence of things that no normal person would think of if they hadn't used the app many times before unless it was specifically explained to them or they saw someone else do it]" or "huh? Didn't you see that the instructions for this are clearly laid out in page 43 of the manual after you execute the steps in Appendix B on page 261?".

    That being said, I think curing people of quality blindness is do-able because I've done it quite a few times. I think this only really works when the person is receptive, as people have infinite capacity for willful blindness but, in cases where people are receptive, just pointing out issues they didn't notice seems to work. Years or even a decade later, people will sometimes tell me they see bugs everywhere now.

    The reason I think this is worth doing is that I've seen people and teams with a high degree of quality blindness ship things that have reduced or even no chance of success because of product quality issues4. It's one thing to knowingly and deliberately trade off quality for speed5, but when I've seen this happen there's always been a kind of quality blindness where everyone involved with the project thinks they're shipping something very high quality when that's not the case.

    2 votes

  3. Comment on GiveWell makes $276 million grant to fund anti-malaria nets in Democratic Republic of the Congo in ~health

    skybrian
    Link
    More in the next blog post: ... Also, the Global Fund to Fight AIDS, Tuberculosis and Malaria (official name) has recently faced funding cuts.

    More in the next blog post:

    The areas of DRC we expect to be covered by this grant have among the highest malaria mortality rates in the absence of ITNs for children under five of any geography where we’ve funded net campaigns in recent years: 0.88%, compared to, for example, 0.73% in our recent grant for nets in Nigeria and 0.47% in Côte d’Ivoire. DRC has a relatively high all-cause mortality rate for children and the highest estimated share of deaths due to malaria among these geographies.

    ...

    Our research for this grant found that despite the need, the available funding for DRC was insufficient to ensure that all areas had net campaigns. The Global Fund is the largest malaria funder in the world; it has a policy of providing no more than 10% of its malaria funding allocation to any one country. Due to this cap, limited funding from other donors, and the high burden of disease, there remains a significant need for nationwide campaigns that GiveWell’s support addresses.

    Also, the Global Fund to Fight AIDS, Tuberculosis and Malaria (official name) has recently faced funding cuts.

    1 vote

  4. Comment on GiveWell makes $276 million grant to fund anti-malaria nets in Democratic Republic of the Congo in ~health

    skybrian
    Link
    From the article: [...]

    From the article:

    GiveWell, with co-funding from Coefficient Giving, recently made our largest grant to date: $276 million to the Against Malaria Foundation (AMF) to support the procurement and distribution of 92 million nets in the Democratic Republic of the Congo (DRC) from 2027 through 2029. We estimate that the nets, 46 million of which we think would not otherwise be distributed, will avert roughly 67,000 deaths. We have supported AMF’s work for more than 15 years, and the insecticide-treated nets it procures and distributes remain one of the most cost-effective ways we’ve found to save lives.

    This grant, which involved a more rigorous investigation process than most, is part of a larger story about scaling our team and systems to handle substantially more funding while deepening our research rigor. Last year, we directed more than $400 million to highly cost-effective programs to save and improve lives and, this year, we expect our grantmaking to approach, and possibly exceed, $1 billion. This increase in grantmaking aims to meet global needs faster and more effectively.

    [...]

    • Planning and coordinating at scale: This grant is nearly three times the size of our previous largest grant (also to AMF) and is concentrated in one country rather than being spread across several. The grant commits funds at the beginning of a multi-year planning cycle, which we think will make these campaigns easier to plan. It also aims to ensure that campaigns happen across all 26 of DRC’s provinces, in some cases on an expedited timeline. This shift in our funding approach makes close coordination with AMF and other partners—including the Global Fund, which is funding much of the net distribution, and the national malaria program—even more important than before.

    • Rethinking how often nets are distributed: In most countries, nets are distributed every three years, but evidence shows that nets wear out more quickly in DRC, in part because of the climate. Our analysis of national survey data, net durability studies, and AMF’s post-distribution monitoring suggests that nets in DRC last roughly 18 to 24 months. DRC had already shortened its campaign cycle, aiming to distribute nets every 30 months. With the support of the government, GiveWell is supporting net campaigns every 24 months in several provinces with high rates of malaria transmission, and funding evidence gathering so we can learn whether more frequent net campaigns is a cost-effective strategy for further reducing malaria rates. We think this approach will help further prevent malaria and potentially save more lives.

    1 vote

  6. Comment on EU packaging regulations land another blow to an already precarious tabletop industry in ~games.tabletop

    skybrian
    Link Parent
    Seems like they could still have a single place to register, even if the laws in different countries have some differences?

    Seems like they could still have a single place to register, even if the laws in different countries have some differences?

    2 votes

  7. Comment on Global trade and United States Navy in ~society

    skybrian
    Link
    From the article:

    From the article:

    The argument here is actually quite easy to state as a series of propositions: global trade is an important part of the global economy, necessary to maintain our standards of living (and in many cases, essential for the survival of people in poorer countries) and seaborne trade makes up the overwhelmingly vast majority of all trade. Moreover, in history to this point it has been a relative constant that in the absence of major naval powers committed to freedom of navigation, pirates and states at maritime choke-points tend to emerge and seriously disrupt maritime trade. Finally, at current, only the United States maintains the kind of navy that traditionally has been necessary to keep sea lanes open, thus making the US Navy at present a ‘load bearing’ component of the global economy. Consequently, this makes the United States’ apparent turn away from freedom of navigation troubling – a move likely to be bad for Americans but also bad for everyone else.

    If you nodded your head through all of those points, you are good to go. Hit the tip jar on the way out. But I find that many folks want to contest at least one of those points – they don’t think trade is important (or that it only enriches ‘big corporations’) or don’t realize how substantial sea trade is, or don’t expect sea commerce to break down in the absence of naval power, or don’t understand the kind of navy necessary to provide that sort of power. So the rest of this far-too-many-words-long post (it turned out to be 10,430) is going to belabor each point, one by one, in order to explain why the United States Navy – which I should stress is very much an imperfect institution; we are not here to uncritically glaze the USN, just to describe its function – is configured the way it is and why there is not currently a replacement for it on offer.

    2 votes

  9. Comment on Donald Trump says he has secured a vast US stake in Venezuelan oil industry in ~society

    skybrian
    Link Parent
    I doubt Trump is thinking very far ahead.

    I doubt Trump is thinking very far ahead.

    4 votes

  10. Comment on Donald Trump says he has secured a vast US stake in Venezuelan oil industry in ~society

    skybrian
    Link
    From the article: [...] [...] [...]

    From the article:

    The plan involves the U.S. taking more direct control over Venezuelan reserves as crime and steep logistical challenges discourage private investors.

    Under it, according to federal officials, the U.S. has gained a controlling stake in nearly a quarter of Venezuela’s untapped oil reserves. It makes the U.S. the majority owner of a giant new joint venture oil company that will hold 100-year contracts at the Venezuelan oil fields.

    The key Venezuelan partner in the deal is Alejandro Betancourt, who controls the second-largest private oil company in the country. Betancourt, 46, has also been the subject of investigations in multiple countries into alleged money laundering and faces a Swiss warrant for his arrest.

    [...]

    Trump also claimed the deal would come at no cost to U.S. taxpayers. But deal points reviewed by The Washington Post and interviews with people who were close to negotiations as the deal came together suggest that for the plan to succeed in producing oil in the amounts the administration projects, the U.S. government may ultimately need to invest significant amounts. Ask The Post AIDive deeper

    A list shared with The Post before the deal was announced noted 17 oil fields in which the U.S. would take a stake. Several of the fields lack any infrastructure or access to transport hubs to treat and move the crude. Those where such infrastructure does exist have fallen victim to years of neglect and theft of machinery.

    Pumping oil from the fields could require investments of many billions of dollars and costly security plans to protect oil workers and production facilities in lawless and violent regions. The deal points reviewed by The Post say the U.S. government stake in the newly formed oil company will be split between equity ownership and guarantees that it will purchase oil produced by it at cost to refill the U.S. Strategic Petroleum Reserve.

    But it is unclear who would make the tens of billions of dollars in infrastructure investments needed before oil can be pumped from the largely dormant fields. Major oil companies have mostly seen such spending as too risky.

    [...]

    Betancourt has become a key intermediary between the U.S. and Venezuela and has helped broker early contracts to get oil pumping fast in the country, The Post reported this week.

    He has ramped up oil output by NABEP to nearly 200,000 barrels per day from 18,000 in just two years. In the past decade, he has also faced multiple investigations, in Switzerland, Spain and the U.S., into alleged money laundering.

    U.S. officials this year have lobbied to resolve the case in Switzerland in a way that would avoid criminal charges and end travel restrictions against the Britain-based Betancourt, The Post reported, citing two people familiar with the matter, who spoke on the condition of anonymity to discuss a sensitive matter.

    [...]

    There is strong opposition in Venezuela to ceding control of natural resources to the U.S. Revisions to the Venezuelan constitution may be required before the U.S. gains control of any oil fields, and the prospects of that happening are uncertain amid U.S. antipathy.

    9 votes

  12. Comment on An environment where multiple AI agents pursue scientific discovery and build a shared literature in ~science

    skybrian
    Link
    From the article: [...]

    From the article:

    The STATION is an open-world, multi-agent environment that models a miniature scientific ecosystem and helps researchers pursue autonomous scientific discovery.

    [...]

    2026-08-24 v2.0 update. We announced Station v2 and its results on mathematical tasks. Across 12 mathematical tasks from AlphaEvolve, Station made new discoveries on five problems. Station also independently rediscovered a counterexample to the Jacobian conjecture within one day. Read the Station v2 paper, Autonomous Mathematical Discovery in an Open-World Multi-Agent Environment.

  14. Comment on htmx 4.0.0 has been released in ~comp

    skybrian
    Link
    "fixi" seems to be a stripped-down version with just the essentials. I'll be asking the AI whether upgrading to 4.0 or fixi makes more sense for my project.

    "fixi" seems to be a stripped-down version with just the essentials. I'll be asking the AI whether upgrading to 4.0 or fixi makes more sense for my project.

    1 vote

  15. Comment on htmx 4.0.0 has been released in ~comp

    skybrian
    Link
    From the article: [...] [...]

    From the article:

    The idea of htmx 4 started to germinate when I decided to create fixi and, in doing so, got more familiar with the fetch() API and async programming in JavaScript. (htmx had always used XMLHttpRequest due to backwards compatibility issues.)

    [...]

    Development has been very smooth. We started a port of fixi + the htmx test suite. Over time, we rediscovered why htmx did many of the things that it did and moved our new implementation closer and closer to the old one. At this point the behavioral differences between 2.x and 4.x are relatively small and where they do diverge we have made explicit choices that we feel will put htmx-based applications in a good spot for being 100-year web services

    [...]

    As mentioned above, htmx 4, from a user’s viewpoint, is almost identical to htmx 2. There are three major changes:

    • Attribute inheritance is now explicit by default rather than implicit by default (this is the biggest upgrade item)

    • The htmx event names have been standardized & cleaned up. Some advanced users may need to change the events they listen for.

    • History support now does not use localStorage by default (which was a cause of many support headaches). Most people won’t notice this at all.

  17. Comment on EU packaging regulations land another blow to an already precarious tabletop industry in ~games.tabletop

    skybrian
    Link
    From the article:

    From the article:

    While this framework is clear about addressing environmental concerns around packaging waste, the reality of how one achieves regulatory compliance isn’t as straightforward. One issue many designers cited is the inclusion of the Extended Producer Responsibility (EPR). Not only do businesses need to adhere to the PPWR, which is being enforced across all 27 European Union (EU) member states, but they must also abide by each country’s specific packaging regulations, with rules and interpretations that can vastly differ amongst one another. At the same time, this includes fees as part of the EPR, an existing policy that producers — companies that manufacture or import goods — are obliged to fulfill. Making matters even more complex is the fact that each EU state implements these EPR fees differently. They may include one payment for registration, and then a secondary payment that varies across countries and is dependent on materials used. Josh Fox, designer and founder of Black Armada, pointed out that some countries, such as Spain, even charge an ongoing annual fee in addition to the initial registration fee.

    "This is another piece of EU legislation that appears not to have considered small businesses at all,” said Fox in an email to Rascal. “Black Armada absolutely loves our EU customers, but we will be going over our sales stats and each member state's fees to figure out which we can still afford to sell to.”

    Several designers and publishers like Black Armada, Genesis of Legend Publishing, and Colin Le Sueur of By Odin’s Beard have immediately ceased shipping to countries that are part of the EU, at least temporarily, until they can figure out their next steps. That’s because one of the primary issues they face is the sheer amount of resources that they need to invest into remaining PPWR compliant. “Multiply [the fees] by 27 states, and you have a big problem,” said Fox. “The best advice for tabletop RPG folks is to figure out which states are sufficiently profitable to offset these fees, and stop selling to the rest. But it's not simple because each member state has its own arrangements, so you need to research each one individually.” Some shared that Fox’s guidance loses feasibility when publishers still have crowdfunding campaign rewards to fulfill. Even Black Armada is still figuring out the logistics of sending games to campaign backers from the EU states.

    Losing access to the EU market is another concern. Jason Pitre, founder of Genesis of Legend Publishing Inc., told Rascal that the fear of incurring prohibitive extra costs has dissuaded him from simply ignoring the new rules — a concern also echoed by Le Sueur. “I am concerned about fines and fees, considering I would have to potentially register with all EU member states or pick and choose who I sell to,” said Le Sueur to Rascal. He added that the PPWR may hinder his reach with his EU audience and result in his inability to sell to the EU market, which amounts to losing 10% of his annual revenue. It’s not an insignificant sum, but he pointed out that it wouldn’t put his business under threat for now. “I’ve spent far too many hours this month navigating these new changes, and with the constant possibility of more on the horizon, I’ll have to make a decision whether to ever resume sales to the EU,” he said.

    6 votes

  19. Comment on Stop Killing The Internet: No digital ID and no age verification in ~tech

    skybrian
    Link Parent
    I broadly agree, but it's not that black and white. Parents will usually know more about what's right for their children than just about anyone else, but they also need support from the rest of...

    I broadly agree, but it's not that black and white. Parents will usually know more about what's right for their children than just about anyone else, but they also need support from the rest of society.

    There's a question about how much vetting you should need to do yourself. For example, reading ingredient lists on all the food you buy is kind of tedious and you shouldn't need to be too vigilant about it, so it's good that some harmful ingredients are banned. Also, the US movie rating system seems like a reasonable way to give a heads up to parents who will make the final call. They could dive into movie reviews or pre-screen everything, but they shouldn't have to.

    2 votes

  20. Comment on Just a rumour of a bug is enough to find a security exploit these days in ~comp

    skybrian
    Link
    From the article: [...] [...] [...] [...]

    From the article:

    I released a security fix for OCaml's cohttp 6.3.0 today, fixing a path traversal issue. The patch itself was straightforward and in normal times, the security procedure would have been to fix it privately, inform affected users, and then issue a public advisory. This time around though, I noticed probes in my live webserver logs with the exact bug pattern just minutes after opening the PR to fix the issue.

    What's worse, I found I could use my own agents to find the exploit just by knowing roughly what it was about and so could have been exploiting it well before the public patch was available! Given that just the rumour of a security issue seems enough to give attackers enough info to find new exploits, we're going to need to change the way we deal with security responses in open source.

    [...]

    Conventional security process involves embargoing the bug, and assumes that secrecy of the details protects users. However, all an agent needs today is a broad direction to search in, and it can do its own research. Fang et al. found that when given a CVE description, their GPT-4 agent exploited 87% of a 15-vulnerability benchmark, and without the description, just 7%.

    Two years on, the mean time to exploit is -7 days. In other words, exploitation now precedes the patch! That same metric looks to be around 63 days in 2018-19, and crossed zero in 2024. A quick search finds lots of other similar cases these days... marimo's CVE-2026-39987 went from advisory to first exploitation attempt in 9 hours, even with no public proof-of-concept in existence. Langflow's CVE-2026-33017 took 20 hours. We seem to have crossed the rubicon for automated exploit generation...

    [...]

    The big engineering shops (like Google) have been building microupdates directly into their software to ensure that fixes directly reach users as a priority over (e.g.) being fixed in the Chrome code repository. We don't really have that kind of luxury in Docker or OCaml, as we don't control the endpoints our software is used in. Aside from Docker Desktop⁠3, downstream distributions quite rightly repackage OSS on their own timescales and terms.

    [...]

    Another thing we could do is to rapidly fix issues in public, ship continuously, and improve the release path via better automation.

    [...]

    However, software packaging is our primary obstacle. Chrome has a relatively easy job of shipping one binary artefact, but OSS is often a bunch of libraries that are then embedded⁠5 in a variety of downstream products. So to do this, we'll need:

    • much better cross-ecosystem package management⁠6 to discover where disparate libraries are eventually embedded. Ryan Gibb⁠7 will talk about this at ICFP next week!

    • better scanning tools to help with triage; Andrew Nesbitt has been doing just this with Scrutineer over the past few months. Thomas Gazagnaire⁠8 and I have been discussing trying this out for our OCaml code, subject to getting access to a reasonable frontier model without security blocks.

    • more robust quality control infra without any false positives that works across the spectrum of supported platforms. While it's relatively easy to run CI on Linux, it's a different story on OpenBSD, FreeBSD, macOS, and some architectures like RISC-V

    5 votes