mschwaig

8 ms·

1. 1.▲
   by mschwaig 3mo ago

   I've been thinking if this could be done in Nix and toyed around with the idea just a little bit using nano-gpt. Hermeticity always seems to mean isolation, but depending on who you ask it does not always mean computing some sort of ha
2. 2.▲
   by mschwaig 8mo ago

   A consequence of universal healthcare that people don't talk about much is that it turns unhealthy citizens from an individual cost into more of a collective one. So it makes sense that countries with universal healthcare regulate in f
3. 3.▲
   by mschwaig 8mo ago

   I think outright shortening copyright terms could be a beneficial policy along similar lines.
4. 4.▲
   by mschwaig 9mo ago

   I would blame how Austria, a very small country, is organized into 9 provinces that actually have their own budget and can pass their own laws on some topics. Rail service is funded at the federal level, so there's less arguing about w
5. 5.▲
   by mschwaig 10mo ago

   If you make a conventional AI agent do packaging and configuration tasks, it has to do one imperative step after the other. While it can forget, it can't really undo the effects of what it already did. If you purpose-build these tools
6. 6.▲
   by mschwaig 10mo ago

   Yes, the cycle times are bad and some ecosystems and tasks are a real pain still. I also agree with you when it comes to the task of auditing every line of Nix code that factors into a given system. Nix doesn't really make things easie
7. 7.▲
   by mschwaig 10mo ago

   I think as AI gets smarter, defenders should start assembling systems how NixOS does it. Defenders should not have to engage in an costly and error-prone search of truth about what's actually deployed. Systems should be composed from b
8. 8.▲
   by mschwaig 11mo ago

   I mentioned another alternative to adding flake-specific metadata to data structures that are transferred over the network, as part of the signed traces or otherwise, in a comment on that PR Eelco linked. It's keeping flake-specific d
9. 9.▲
   by mschwaig 1y ago

   As a current PhD student (working on Nix stuff) let me take this opportunity to congratulate you on your successful PhD defense and publicly thank you for your writing. That you write and what you write are inspiring.
10. 10.▲
    by mschwaig 1y ago

    I work with Nix a lot, and I had never seen `__findFile`. It's kind of crazy how much there is to know about Nix. I wish there was a bit less surface area to the language. On the other hand it's really interesting how much special
11. 11.▲
    by mschwaig 1y ago

    Human-readability was one of the aspects that I enjoyed about using CCL,the Categorical Configuration Language ( https://chshersh.com/blog/2025-01-06-the-most-elegant-config... ), in one of my projects recently. It saves
12. 12.▲
    by mschwaig 1y ago

    I wrote a paper about how I think trust should work for software dependencies. It very much builds on the hash-based cache lookup mechanism this paper calls constructive traces (in contrast to what they call deep constructive traces ) to
13. 13.▲
    by mschwaig 2y ago

    Thanks, and thank you for reading! :)
14. 14.▲
    by mschwaig 2y ago

    I want to try to become an independent researcher, when the funding for my PhD position runs out. My idea for financing this is finding a few companies who pay a retainer fee to not only get direct easy access to my expertise when they need
15. 15.▲
    by mschwaig 2y ago

    That's great. Feel free to reach out if you want to, I'm happy to answer any questions. It's basically my job, that I really love. :)
16. 16.▲
    by mschwaig 2y ago

    I know about mass rebuilds, but in the parent comment you were talking about fixed output derivations, and committing the hashes for a mass rebuild to version control is technically possible, but not a reasonable workflow, because it makes
17. 17.▲
    by mschwaig 2y ago

    Yes. Reproducibility also makes it possible to aggregate information about the links in dependency trees and distribute trust on that basis. That stuff is useful to humans, but it is also really useful for cold hard automated logical reason
18. 18.▲
    by mschwaig 2y ago

    You also couldn't feasibly do that for derivations that actually build packages, instead of fixed output derivations only, because if you the update the package set to include a newer version of the compiler, which would often produce
19. 19.▲
    by mschwaig 2y ago

    There are also some other gaps left to close to implement this vision, mentioned in this post an my reply to it: https://news.ycombinator.com/item?id=43030046
20. 20.▲
    by mschwaig 2y ago

    I think it would have been a good thing to mention, but difficult to do well in more than a quick reference or sidenote and could easily turn into a extensive detour. I'm saying this as someone who's working on exactly that topic.
21. 21.▲
    by mschwaig 2y ago

    Ollama tries to appeal to a lowest common denominator user base, who does not want to worry about stuff like configuration and quants, or which binary to download. I think they want their project to be smart enough to just 'figure out
22. 22.▲
    by mschwaig 2y ago

    I think its great that Julien and his coauthors actually show some evidence of Nix working at scale, to successfully rebuild the vast majority of things, and bit-by-bit reproduce a significant portion. Lots of people have been working on th
23. 23.▲
    by mschwaig 2y ago

    Tools should surface information on the right level of abstraction for their users, and tools should have good UX no matter how much or little their users know. Signature verification tools on the command line do not surface enough informat
24. 24.▲
    by mschwaig 2y ago

    I really wish we would take defining what it means for an artifact to be signed more seriously. Which key(s) is it signed with? What is the hash of the corresponding unsigned artifact? Signature verification tools should have some option wh
25. 25.▲
    by mschwaig 2y ago

    Of those 100 announcements, 17 are not directly related to AI: 61-64, 66, 68-72, 75, 76, 85, 86, 88, 89 and 91. 5 look like they involve AI (would need to check): 43, 49, 56, 60 and 67. 78 are clearly related to AI somehow.
26. 26.▲
    by mschwaig 3y ago

    From the Model Card on Needle In A Haystack evaluation > One aspect that has caught our attention while examining samples from Claude 3 Opus is that, in certain instances, the model demonstrates a remarkable ability to identify the synth
27. 27.▲
    by mschwaig 4y ago

    I have not used Dependabot myself, but I wrote a tool that runs in a nightly CI job and creates or updates a single PR per repo with all of the dependency updates. You can then merge those with the push of a button. I think that's bett
28. 28.▲
    by mschwaig 4y ago

    Thanks, I had not heard of Tvix yet. What do you mean by day 1 reproducibility instead of repeatability? Isn't tracking and eliminating nondeterminism a gradual process anyways? I don't see how nixpkgs or NixOS is a faulty basis f
29. 29.▲
    by mschwaig 4y ago

    Theoretically languages other than Nix can be used to generate derivations and from that point forward to the finished build result everything should work the same way. There is already some experimental setup for Nix to call Nickel for pro
30. 30.▲
    by mschwaig 4y ago

    Yes sorry. This was a typo. I meant to write 'a few options'.