DigitalOcean simply does this at a later stage and will then just cut you off, Hetzner is doing it from the start. Their obligations aren't so different, they just approach this differently. It's the same thing with Stripe, it's cool that they just let you sign up and process transactions but at some point they will look at your business and if they don't like it they will just cut you off.
Also Hetzner really doesn't care much about individuals as far as I know, they mostly do business with other businesses and that's where the money is, their business is not designed to handle millions of individual users, DigitalOcean might also simply have a different strategy there.
Hetzner is totally fine with individuals, they're probably sad to get less money but they don't care. Remember that in Germany a GmbH company costs $25,000, and if you're not a GmbH you're (in most cases) an individual sole trader.
They're also a bit picky with who they allow to sign up and they discriminate by country of origin. I had no problem being from a first world country with a passport, but I've heard the horror stories. If you're from Asia or Africa you may have an issue - if you have a registered business (even a sole tradership) in Europe, that would probably help convince them.
Takes me back to when I was working on Josephson junctions (JJ) as a student, I-V curves were the first thing we did when characterizing a junction. JJ I-V curves were tricky due to the hysteresis they have in the underdamped regime, so we had some pretty involved stepping logic to ensure we get the curve with the required precision.
That said today everything is pretty much digital, you have Acqiris/Agilent 1 GHz ADCs and all the measurements are done in software, but I still remember using my old 20 MHz HMAG oscilloscope in XY mode with a triangle voltage generator to plot IV curves in real-time. Good old times!
Congrats Sonali, Nick, Dave & everyone else! I had an incredible time with you all in NY more than 10 years ago, it was so cool, and I'm still thinking of it very fondly. Spent my days hacking away in the space near Canal Street and the nights and weekends exploring NYC with other Recursers, visiting museums, parks and venturing out to buy cheap dumplings by the dozen. I was quite poor back then but I enjoyed my life so much, had a tiny room at the Kolping house on the Upper East Side which was very run down and tiny but also very cheap, basically just went there for sleeping and spent every other minute in the space and outside. No distractions, no possessions beyond my laptop, no responsibilities, simple but happy times. And then in 2021 I found my dream job at DuckDuckGo through RC, been working there for almost five years now! Thanks for everything and great to see it's still going strong!
Interesting that on one hand the valuation of these AI providers is based on the assumption that all code (and everything else producing digital artefacts) will be written using AI in the near future, on the other hand almost all popular open source projects fight to keep AI contributions out. Hard to reconcile.
Personally I'm also experiencing a bit of AI hangover after using it a lot in my own open-source projects. I find it's a bit like taking drugs (not that I have much experience with that) in the sense that in the moment I'm using these tools I feel great and powerful, writing features in a span of hours that would've taken me weeks to write by hand. But inevitably some time later I will look at the code and notice all the subtle cracks and inconsistencies the tool introduced, and despair a bit at the mess.
I now plan to use these tools less for extensive feature development and more for planning, debugging and narrow refactoring where I can put very strict guardrails on them. I'd still say it accelerates my work but not by a factor of 10, more like 1.5-3 (which is still a lot) given the care you need to ensure what is being built is actually good. For what I really like these tools is that I need less mental focus to do coding, but on the other hand I have this new kind of fatigue of being in a constant chat loop with a machine and trying to get it to do stuff based on natural language, never knowing how it will interpret what I write and wrote before. In that sense, these tools don't feel satisfying, it's like operating a machine where you try to push some buttons to get it to do something but the internal wiring changes all the time so you never know exactly what a given button combination will do and you have to figure it out by watching the machine and constantly adapting.
The key problem is that traditionally, OSS contributions were self-selecting. Basically, to create a PR, you had to be invested in the project. To create a contribution of value, you had to understand the codebase, the conventions, engage a little with the project, and generally the folks doing it are doing so because they like the project, or because they are scratching a specific itch they have etc.
What AI unlocks is contributions from folks who are not at all involved in the project, and creating a PR is no longer enough to clear the gate of “this person is at least somewhat interested in the success of the project”.
AI is a force multiplier when wielded properly, but as an OSS maintainer, it’s easy to drown in prolific, low value “contributions” from folks who don’t care about the project.
I think drugs are actually a great analogy. An initial feeling of "oh my god I have superhuman capabilities" followed by a hangover of "ohno I have created a mess". Especially with AI sycophancy where it's like "Great idea!" all the time. (I am well aware most my ideas are not great, thanks). Honestly, even the way people talk about like vibe coding on their phones while they're with their kids or something, it almost sounds like a compulsion.
> An initial feeling of "oh my god I have superhuman capabilities" followed by a hangover of "ohno I have created a mess".
Continuing the analogy: if this happens, then you are using the wrong drugs or you are using the drugs wrong. It's not like there's an axiom "you can't enhance your performance without detrimental side-effects."
Yes. It is not true that anything that makes our lives better or work easier is bad. In fact that's the story of all progress - making peoples lives better and work easier.
> the moment I'm using these tools I feel great and powerful, writing features in a span of hours that would've taken me weeks to write by hand. But inevitably some time later I will look at the code and notice all the subtle cracks and inconsistencies the tool introduced, and despair a bit at the mess.
Very relatable. I wasted 2 weeks of full time effort earlier this year building a helper library with Sonnet. It was the first (and the last) time I vibe coded something. Once I was satisfied with it, I began using the library and within 2 days I was certain it was all for nothing. I will never get those 2 weeks back, but a lesson has been learnt.
Totally! The feeling of using AI to create something not fully productive is similar to the "just one more turn..." effect when playing a Civilization game. Even when you realize it's a waste, it's hard to stop, because the next dopamine hit is just around the corner.
They have much in common with slot machines, yes. It's no accident, many of the lessons from exploitative mobile games are being reused in LLM UIs. Rename "tokens" to "gems" and the situation looks very familiar.
The modern software development ethos is based around the idea that you don't know to what destination you're ultimately going.
If you missed your destination, the solution isn't to think deeply about where you're supposed to go, it's to drive faster towards the next goal, so that if you make a mistake, it's not that big of a deal.
The slow moving projects didn't have some magic knowledge about where to go, they made the same mistakes but at a slower pace.
But all of this relied on the fact that code went through the brains of a human and said humans intelligence gets updated from the feedback, so that the developer builds a theory/model of what the software is really meant to look like in the end.
With AI, there is no such model. A context window is more like a tape or a film. The human is still responsible for building that mental model.
> Interesting that on one hand the valuation of these AI providers is based on the assumption that all code (and everything else producing digital artefacts) will be written using AI in the near future, on the other hand almost all popular open source projects fight to keep AI contributions out. Hard to reconcile.
Oh, it's not hard to reconcile at all.
On one side, you have people trying to sell you a product claiming that the product is the most amazing, indispensable thing ever.
On the other, you have the people dealing with the product's actual use evaluating it and finding it wanting.
The only reason this even looks hard to reconcile is because the people trying to sell you the product have been given more money than God (partly by people who think the product will become God).
Ignore the hype. Pay attention to the actual results.
the assumption that all code (and everything else producing digital artefacts) will be written using AI in the near future,
This is what AI providers wanted you to believe in because they have a couple of shovels to sell to you. Once you realize that the assumption is delusional, it's no longer hard to reconcile.
There's this crazy narrative that everyone starts parroting, saying the days of writing code yourself are over, now we have to use agents for everything.
No, we don't have to. We can just write code ourselves.
(My condolences to people who have jobs where AI is mandated.)
I'm in that boat - my current employer recently announced that they are tracking AI usage across the company and if you're not using enough AI you will be "replaced by someone who does".
> in the moment I'm using these tools I feel great and powerful, writing features in a span of hours that would've taken me weeks to write by hand. But inevitably some time later I will look at the code and notice all the subtle cracks and inconsistencies the tool introduced, and despair a bit at the mess.
My suggestion would be that instead of sometime later, review incrementally as part of your process. Treat AI as just the tool for writing, just as if you handed it off to a junior. Replace "junior" with "AI" in the SDLC and keep everything else the same.
I don't think it's that hard to reconcile. The tools are being massively oversold and we are in a bubble. I think things will settle down to a reasonable middle ground in ~2 years as the checks being written right now start coming due and we are forced to figure out what they actually are and aren't good at. Infinite money distorts markets, it's currently not a good time to be judging these things for the long term perspective.
I have recently updated zed to the latest version which has parallel agents and all the other brainrot.
I gave it an innocuous 2 sentence prompt, telling it to help me implement it, by building X first.
It produced code, and it was a big wall of code, which I expected. What I didn't expect is that the zed developers completely threw out the accept/reject workflow since Codex is no longer directly integrated into zed anymore.
Instead of the agent patiently waiting for my acceptance, it just kept going, it automatically ran cargo test, kept iterating like a dozen times, running cargo test and editing the code. Since I was in the middle of a big refactor, I kept a dozen compile errors as a reminder. It tried to "fix" these compile errors.
Then it proceeded to keep going even further and use the code to finish a file that was supposed to use the new code in the future.
The end result is as expected: It produced completely unusable garbage code that no sane person would sign off on and not just that, it used this garbage code and kept going with it, building more garbage on top of a garbage foundation. It also silenced the errors by producing more garbage code.
I'm the type of person that thinks the "accept always" button for specific commands is the dumbest idea ever [0], but they went one step further and basically made the agentic coding experience so bad it became unusable overnight. At this point I'd rather abandon agentic coding and go back to copy paste development with a chat interface.
[0] it's either accept or reject, everything else is stupid
Corporations will be quite happy with really simple features if they're packaged right. I'm selling software that mostly does things that a good programmer could whip up in a couple of days or weeks, but what cost me most of the development time wasn't the features but all the FUD around them e.g. SSO, multitenancy, audit logs, corporate design support, ... Most enterprise software could be replaced with simple scripts and command line tools if they had this enterprise layer. I'd wager tons of SaaS is just simple open-source software and libraries behind a management layer.
It is difficult to retire with house equity. Housing is just one element of what you need to have in retirement and after a certain point, and especially in retirement, once the house is what you plan to stay in forever it is better if it is worth less (all other social factors aside) so that you don't pay as much in taxes on it.
The point is usually to sell a big house in a desirable location, buy a modest house in a less posh an tax-lighter location, and invest the difference to have a steady stream of income.
Prices have been coming down for years in nominal terms, let alone real terms. Cg nat does everything that’s needed, there are no significant ip6 only services, there are plenty of ip4 only services, so you have to support ip4 anyway, so why bother with ip6
My company has just turned off all ip6 connectivity for its corporate laptops because it’s considered a security risk. I disagree, but I do agree that having 4 and 6 is a higher risk than 4 alone or 6 alone, and 6 alone sadly still doesn’t work reliably.
All the “promise” of ip6, direct connections etc, were lost when stateful firewalls became required and memory became cheaper than $20 a megabyte. Some bespoke old protocols don’t like ports changing, which can be a problem, but it’s a very small number and easier to work around with modern protocols than support a dual stack environment securely for the majority of places that struggle securing a single stack.
Except for making it convenient for end-user to, say, play P2P video games, or host Mindcraft servers, etc.
> […] and 6 alone sadly still doesn’t work reliably.
It's so unreliable that half of all Internet traffic uses it. It's so unreliable that Microsoft has been going IPv6-only in their corporate networks (a decade ago):
Everything that's needed besides letting computers talk to each other, that is.
With ipv4 you have a two tier internet. Computers talk to servers, servers talk to servers, computers can't talk to computers so every video call must be routed through a server.
I hear this as a cited as a benefit of IPv6 a lot. Honest question: Isn't this at least a privacy issue, at most a security issue? SLAAC seems like what we already have with extra, breakable steps, which doesn't effectively address the privacy issue anyway.
That the server can figure out that two computers in the same house are different since your laptop and phone no longer share the same ipv4 address but instead have two ipv6 address?
Security? NAT is not a firewall, you need a firewall, and switching to IPv6 does not remove your firewall.
Before IPv6: The server gets "1.2.3.4:56789" for your device. After IPv6: the server gets "1:2:3:4::56" or whatever for your device. In either case, if the server makes a connection to 1.2.3.4:56789 or 1:2:3:4::56, your router sees the packet and firewalls the connection. Cool.
Want to give me a concrete example of where IPv6 is hurting my privacy or security, because I've been using it for over a decade with zero mishaps, zero privacy issues, zero security issues (to my knowledge at least)
I've only read that on HN, I've never heard this anywhere else. Since it's been a good 20+ years since my CCNA (and haven't needed to renew it since), could you please offer a real-world example where NAT is not a firewall w/ practical examples relating to 99.9% of cases of home use? I just can't get why people say this a lot here.
NAT works and passes the grandma test. If grandma buys a crappy vulnerable 40$ printer and plugs it in, even if it accepts unauthenticated stuff on every local port, you will not be able to connect to it behind NAT. So what's the difference? The only way I could think this can apply is if the ISP is compromised or criminally mismanaged, in which case you probably already have bigger problems.
So does my Asus with a default deny IPv6 rule on incoming connections.
You're more likely to click on a link that installs malware that attacks your network from the inside, and that attack works regardless of IPv4 or IPv6.
Treating a firewall as some impenetrable moat has not been network security practice for a decade(+), and waving around RFC 1918 address space like systems with a 10.8 or 192.168/16 can't get infected is lazy thinking. It leads to complacency: I'm behind NAT, I'm safe.
Grandma’s ISP can send RFC 1918 traffic to her router and likely be able to directly connect to every internal host. You should have learned in your CCNA training that NAT makes it harder to send inbound traffic to a system, but doesn’t by itself provide the filtering that a firewall does.
Right, I get that. I can see the ISP angle. But my question was specifically for outside attacks. Tangible, real-world threats in existing ISPs, reachable from the outside.
If we're talking tangible, real-world threats in existing ISPs, then NAT is doing nothing to protect you. In fact it's doing the exact opposite, because without NAT you wouldn't be able to connect out from your network.
Even if you want to ignore the fact that most attacks arrive via outbound connections and restrict the discussion to just inbound ones... remove NAT and the exact same set of people that could connect to you before can still connect to you, so it's doing nothing for your inbound connections.
NAT was not designed as a security boundary. Sure, it may block some kinds of incoming traffic accidentally and as a side-effect disrupt some attacks.
But why would you rather have an always-broken network that might block attackers instead of a deliberate "deny incoming" rule that does exactly what you want -- and that you can punch holes in if desired?
Instead we have apps circumventing this accidental barrier with STUN, uPNP, etc with little/no oversight and we also regularly encounter brokenness.
I agree. NAT, while occasionally limiting, was a godsend. Just imagine how the world would look if everyone out there was at the mercy of a well configured router with firewall.
They used to recommend using the MAC address. This was ok 30 years ago when a computer sat in an office on a desk but it makes it very easy to fingerprint a moving computer as it moves across different networks.
Using a random address (Privacy Extensions) solves this problem though, but do we expect everyone to know what that is and check it's enabled? Mine wasn't enabled by default (on Linux) and I only noticed when a bittorrent site warned me.
Everything useful is a security issue. Security is a trade-off, not a positive stat you maximize. Every security tightening removes some utility from a system; the hope is that this disproportionally disrupts the "bad actors" over "good ones".
(All of that hinges on the key question that people seldom ask: what is being protected, and from who. The "two-tier" Internet is, in a way, pointing out a case where regular users are seen as threat actors.)
Yes. Letting anyone talk to anyone was the point of the internet. It's been co-opted by these massive centralising forces and you know what? They're right. With IPv4 everything has to be centralised, we don't even have the faintest chance to avoid it. With IPv6 at least we have a chance to take it back.
Some people will mention stateful firewalls. They're pretty easy to holepunch through because you just need each side to send a packet to the other, then each firewall sees it as an outgoing connection and allows it. It's nothing like IPv4 NAT.
> My company has just turned off all ip6 connectivity for its corporate laptops because it’s considered a security risk. I disagree, but I do agree that having 4 and 6 is a higher risk than 4 alone or 6 alone, and 6 alone sadly still doesn’t work reliably.
I had a very concreteish security risk with IPv6 and openvpn. At least in Debian config openvpn tunneled only IPv4 by default. I only noticed this by being surprised I got results tailored to my origin country instead of the VPN out node country.
It's eternal (dual stack) paper cuts like this why just turning IPv6 off makes life a lot easier.
It's quite easy to write a generic Maybe struct that performs most of the encapsulation that Rust's Maybe does i.e. allow unwrapping of the inner type through a function or handling the nil case through a switch like statement. I've never seen this in the wild which makes me think people don't care about it too much. And of course it's runtime based so no compile time guarantees, and just to preempt the expected replies I know it's not the same what Rust is capable off and Rust is of course a much much much much better language than Go.
Personally I do experiment with these things as it makes code more readable, it just seems adoption for generics and what you can do with them is still quite low in the broader community. That said I do not deal with null pointer exceptions much at all, and when I do it's often relatively simply to spot and fix, so for me it's not a large issue.
I think for mostly search-focused use case like the one presented here AI is great as you don't ask it to build stuff or invent new drugs, you just want to retrieve relevant documents with laser precision, and agents can do that.
I think right now I'm mostly disappointed with agents writing code as they always degrade the quality of the codebase after a while, and the same goes for writing in general which just requires a ton of editing and mostly just sounds good but doesn't have a lot of substance in the end. I think you can really tell that these systems are trained to just produce plausible streams of text, especially in longer artefacts you notice that locally the inner consistency of what they produce is great but globally it really falls apart, it's like seeing the limits of their "intelligence".
For search however I really like AI, it has improved information retrieval so much for me where before I had to think about which keywords to use and combine and which filters to apply, describing what I'm looking for in plain text and then having the AI find it for me feels magical. Recently I wanted to find an artist that I heard in some old episode of the KEXP runcast (a running podcast), and I didn't remember anything except that it was rap with a kind of monotone voice a fast beat and a strong accent. Googles' agent asked a few clarifying questions and after a few rounds it found the artist for me, Genesis Uwusu. That's why I think Google will win in the AI assisted search market, they just have the best integration between fast and reasonably "smart" agents and high quality search data. Claude or ChatGPT are too slow and don't have fast enough data retrieval it seems, using them for search feels quite sluggish in comparison.
> you just want to retrieve relevant documents with laser precision
My experience with using LLMs for search is that they do _not_ have laser precision. Far from it in fact. If you want to retrieve documents with laser precision AI is the wrong tool. If you want a fuzzy, lossy synthesised query response based on those documents, LLMs are great.
Apple RAM prices always had quite a bit of margin though, I think they charged around 4x the going market rate per GB (that said you can't fully compare their RAM to a loose DIMM stick). I was planning to pick up a new Mac Studio this autumn, now I'll have to see if I can afford it, though I have been spending 1,000 USD on LLM subscriptions in some months so I guess even a 10,000 USD Studio Mac amortizes quite fast if it allows me to run coding models locally.
I would wait until the next Mac Studio. Rumors are it will have 768GB max memory and with the M6 Max chip, even faster prefill. I feel like it’s the endgame.
Probably will be but I have a feeling the days of $20 and $100 coding plans are winding down. Now that people are so used to using agents, they will raise prices and tighten their grip. At $20k, I might be tempted.
IIRC modern Apple devices integrate the memory into the whole SoC instead of making it separate on the board and replaceable. It's definitely not swappable like a DIMM or CAMM module would be. Can't find a photo of a decapped M4 chip to prove it, though...
Everyone always wants to charge as much as they possibly can, and if SK Hynix would be the only manufacturer prices would be 10x of what they are today. Especially new incumbents will not ruin the market prices as they have the highest upfront cost and their calculation of entering the market is probably based on the high prices that can be achieved. In the long run, more competition is still good as everyone ramps up production to profit more from the high prices and at some point supply will outpace demand and prices will fall (assuming no cartel / price fixing is involved).
Also Hetzner really doesn't care much about individuals as far as I know, they mostly do business with other businesses and that's where the money is, their business is not designed to handle millions of individual users, DigitalOcean might also simply have a different strategy there.
reply