Top all-time · #12202
Matthew Holt
Personal blog · matt.life/writing · on HN as mholtprogrammingculture
Matthew Holt's personal blog at matt.life covers programming and culture. Since 2017, 6 different Hacker News readers have linked it 18 times, most often “The Asymmetry of Open Source”. No feed was found, so read it on the site itself.
Most-linked posts?
- The Asymmetry of Open Source6 people · 12 mentions · first linked 2021-12-22
What Hacker News says?
Good on him. I wrote fairly comprehensively about boundaries in open source recently: https://matt.life/writing/the-asymmetry-of-open-source A lot of principles are familiar here. Love to see it. Open source is no cakewalk, especially without boundaries.
Comment linking /writing/the-asymmetry-of-open-source
on “My boundaries as an open source developer”Submitted The Asymmetry of Open Source as a story · 121 points
HN discussionVery related: about a year ago, I wrote about weaknesses of neural networks specifically: https://matt.life/papers/security_privacy_neural_networks.pd... With powerful machine learning systems, we need to think about security a little differently. See especially the section 4.8 about function approximation: > Given a task for which no discrete algorithm is known to solve, there is a good chance a neural network can…
Comment linking /papers/security_privacy_neural_networks.pdf
on “Attacks against machine learning – an overview”Submitted The Asymmetry of Open Source as a story · 4 points
HN discussionHey, it sounds like you'd like my essay on this: The Asymmetry of Open Source: https://matt.life/writing/the-asymmetry-of-open-source
Comment linking /writing/the-asymmetry-of-open-source
on “There is no “software supply chain””Submitted The Asymmetry of Open Source as a story · 3 points
HN discussionIf you like this kind of thing, I wrote a little document summarizing the security and privacy weaknesses of neural networks during grad school a couple years ago: https://matt.life/papers/security_privacy_neural_networks.pd... I _think_ most of the content in there is still relevant/valid, but the field moves so fast (with dozens of papers written every day on average, it's actually one of the main reasons I switch…
Comment linking /papers/security_privacy_neural_networks.pdf
on “Hacking Neural Networks: A Short Introduction”Submitted The Asymmetry of Open Source as a story · 3 points
HN discussionI want to submit a PR to remove Caddy from the "open core" category... or at least add it to several other categories which helped make it possible for me to work on Caddy full-time. Open Core did not work for us (hence the link to the retrospective). At first it was a donation button, then an award from Mozilla (MOSS) -- kind of like a grant but they emphasized it was not technically a grant, probably for legal rea…
Comment linking /writing/the-asymmetry-of-open-source
on “A handy guide to financial support for open source”Submitted The Asymmetry of Open Source as a story · 2 points
HN discussionI also wrote about this in some depth recently (but for maintainers): https://matt.life/writing/the-asymmetry-of-open-source (discussion: https://news.ycombinator.com/item?id=30706650 ) I'm glad Filippo is de-stigmatizing high-tier sponsorships: > Designing, building, managing, and growing an Open Source project demonstrates all the skills required of a Senior Software Engineer. That means maintainers can access $15…
Comment linking /writing/the-asymmetry-of-open-source
on “How to Pay Professional Maintainers”Submitted The Asymmetry of Open Source as a story · 1 points
HN discussionA bigger concern in my mind is where 100% accuracy is needed, like when doing authentication (cf. any login screen that lets you in by looking at your face). A lot of experiments are done on visual data sets, but I don't see why these techniques need to be strictly for visual inputs. Is a machine learning model making decisions based on the results of its classifier? Then it is at risk of being fooled, and whatever…
Comment linking /papers/security_privacy_neural_networks.pdf
on “Robust Physical-World Attacks on Machine Learning Models”Since this blog post was written, the same authors have published further research on transferability which is what really makes these hard to defend against. They even present a proof of concept task that is resistant to transferring (although it is not super practical): https://arxiv.org/abs/1704.03453 If it interests anyone, I wrote up a bit about this and other threats related to machine learning models, a few w…
Comment linking /papers/security_privacy_neural_networks.pdf
on “Attacking Machine Learning with Adversarial Examples”Love to see this kind of leadership from stewards of open source. I hope more companies will follow their lead in general. (Not necessarily saying this approach is the most effective, but the messaging is in the right direction!) Netted about $25 from their funding round, which is very nice. I can imagine if 1000 companies did this, then on average, many open source maintainers would have their living expenses cover…
Comment linking /writing/the-asymmetry-of-open-source
on “We Just Gave $500k to Open Source Maintainers”If Gina is reading this, can I just say: wow! It's so cool that you've had hundreds of sponsors on GitHub (almost 1000!) and that's really exciting size for a user base! I see you're seeking corporate sponsors. Awesome -- I think this can offset a significant amount of your expenses and pave the way to sustainability. IME it is much easier to sign on a handful of business sponsors than it is to get hundreds or thous…
Comment linking /writing/the-asymmetry-of-open-source
on “We need to talk about funding”This resonates. Unfortunately, the CVE database(s) are too noisy to be useful. It could benefit from higher standards and more thorough vetting. (Maybe take some lessons from academia.) A "security researcher" once filed a CVE for a regular bug in Caddy [0], making claims that were totally provably false. It was assigned 7.5... the same as Heartbleed [1] -- yes, the one that leaked almost all the private encryption…
Comment linking /writing/the-acme-protocol-in-practice-and-reality
on “The Bogus CVE Problem”This is true, if you manually configure a CAA limited to just one CA, then you lose that benefit of redundancy. I recommend trusting multiple CAs (but not too many): https://matt.life/writing/the-acme-protocol-in-practice-and-... > (I don't know if it is, but I would think it's a layering violation for an HTTP server to also be a DNS server.) Caddy 2 is, at its core, a server of servers. The HTTP server is just an "…
Comment linking /writing/the-acme-protocol-in-practice-and-reality
on “Let's Encrypt Acme API Outage”
