aris

AI Engineer with full-stack software development background

[David Senra @davidsenra]

My conversation with @RickRubin

0:00 Less Is More But Harder
2:00 Def Jam From The Dorm Room
4:00 Capturing Club Energy On Record
6:00 Going Deep On Influences
12:30 Why Reduced By Rick Rubin
14:00 Beatles Structure Meets Rap
16:00 The Ruthless Edit
19:30 Eminem: The Most Obsessive Artist
22:00 Lazy Workaholic
25:30 Protecting The Moment Of Magic
29:00 Dana White And Becoming A Podcaster
32:30 Professional Listener
44:00 Fishing And Showing Up
47:00 Johnny Cash And Constraints
55:30 Church Business vs. Banking Business
58:50 Run On Intuition Alone
1:01:00 Jay-Z vs. Eminem Process
1:04:30 In Service Of The Artist
1:09:00 Work As Diary Entries
1:13:30 Four Ways Success Destroys You
1:16:00 How To Sustain Success
1:21:00 The House On The Mountain

Includes paid partnerships.

[David Senra @davidsenra]

This conversation with @RickRubin is special. Here's a 2 minute preview that I’ve watched 15 times.

The episode will be out tomorrow:

[Y Combinator @ycombinator]

In a recent batch talk, YC General Partner @t_blom broke down how to build a self-improving, AI-native company.

He walks through how to create recursive, self-improving AI loops, and why founders who get this right will run companies that improve while they sleep.

00:00 — Companies Are Roman Legions
00:54 — Copilots Are the Wrong Mental Model
01:55 — Extract the Domain Knowledge
02:24 — The Recursive Self-Improving Loop
04:12 — The Holy Shit Moment at YC
05:50 — Self-Optimizing Product and Support Loops
06:29 — Burn Tokens, Not Headcount
07:23 — Middle Management Is Over
08:05 — Make Everything Legible to AI
09:40 — Regenerating the YC User Manual
11:19 — Software Is Ephemeral, Context Is Valuable
12:18 — Where Humans Still Matter

[Simon Brown @simonbrown]

Spec-driven development makes very little sense to me.

The software development industry has repeatedly shown that devs don't like writing docs, often saying "it's tedious and time-consuming; I'd rather be coding".

- How will this turn out to be different?
- Why automate the fun part (coding) and force devs to write docs instead?

https://t.co/CYxnCgeBmp

[aris @aristofool]

💡 总结
AI 极大地解决了“怎么写代码 (How)”的效率，却把“为什么这么写 (Why)”的资产彻底弄丢了。如果无法解决 AI 时代代码意图的留存和架构共识问题，现在用 AI 写的每一行代码，都在给未来的系统埋下技术债务的定时炸弹。
大家团队有遇到类似问题吗？有什么解法？#AICoding #软件工程 #大模型

[aris @aristofool]

团队正在全面推行 AI Coding ，我们发现了一个严重的隐藏风险：代码产出极速飙升，但团队的“共享架构上下文”正在走向崩溃。
AI 正在把我们的代码库变成一个没人懂的“巨型黑盒”。长期以往，线上服务可能将面临巨大的维护危机。🧵👇

[aris @aristofool]

3️⃣ 连操作者本人也成了“局外人”
如果你不在那台特定的电脑、那个特定的 Agent 会话里，你根本拿不到当初的设计依据。
更危险的是，当时敲下 Enter 让 AI 生成代码的同事，往往也跳过了思考过程，忽略了深层原因，转头就忘。代码跑通了，但没人知道它是怎么通的。

[aris @aristofool]

"Be Curious, Be Fearless, and Hack the Planet."

[Bilgin Ibryam @bibryam]

How I Learned Everything I Know About Programming
https://t.co/yRPbiIwoQ2

[aris @aristofool]

@tison1096 @Piglei 请问是 GoF 的《设计模式》一书吗？

[dex @dexhorthy]

Everything is context engineering

[Anthropic @AnthropicAI]

New Anthropic research: Building and evaluating alignment auditing agents.

We developed three AI agents to autonomously complete alignment auditing tasks.

In testing, our agents successfully uncovered hidden goals, built safety evaluations, and surfaced concerning behaviors.

[LovartAI @lovart_ai]

No more invite codes. Lovart goes public today.
Thanks to the 800,000 of you on our waitlist and our many beta friends who helped us prove Lovart's capabilities – but we wanted to make it better for you.
Design agent capabilities are just the beginning. True creativity accelerates when humans and AI collaborate naturally. So we built ChatCanvas: the conversational medium where you and your AI agent think together, visually.
The agent creates. ChatCanvas transforms how. Welcome to the future of AI agentic design.
#Lovart #LovartAI #CreateWithLovart #LovartLaunch

[AI Will @FinanceYF5]

🚨 新闻：Google 刚刚发布了 2025 年免费的 AI 课程。

无需费用，无需经验。

以下是你需要收藏的 10 门课程：

[Andrej Karpathy @karpathy]

I wrote a quick new post on "Digital Hygiene".

Basically there are some no-brainer decisions you can make in your life to dramatically improve the privacy and security of your computing and this post goes over some of them. Blog post link in the reply, but copy pasting below too.

Every now and then I get reminded about the vast fraud apparatus of the internet, re-invigorating my pursuit of basic digital hygiene around privacy/security of day to day computing. The sketchiness starts with major tech companies who are incentivized to build comprehensive profiles of you, to monetize it directly for advertising, or sell it off to professional data broker companies who further enrich, de-anonymize, cross-reference and resell it further. Inevitable and regular data breaches eventually runoff and collect your information into dark web archives, feeding into a whole underground spammer / scammer industry of hacks, phishing, ransomware, credit card fraud, identity theft, etc. This guide is a collection of the most basic digital hygiene tips, starting with the most basic to a bit more niche.

Password manager. Your passwords are your "first factor", i.e. "something you know". Do not be a noob and mint new, unique, hard passwords for every website or service that you sign up with. Combine this with a browser extension to create and Autofill them super fast. For example, I use and like 1Password. This prevents your passwords from 1) being easy to guess or crack, and 2) leaking one single time, and opening doors to many other services. In return, we now have a central location for all your 1st factors (passwords), so we must make sure to secure it thoroughly, which brings us to...

Hardware security key. The most critical services in your life (e.g. Google, or 1Password) must be additionally secured with a "2nd factor", i.e. "something you have". An attacker would have to be in possession of both factors to gain access to these services. The most common 2nd factor implemented by many services is a phone number, the idea being that you get a text message with a pin code to enter in addition to your password. Clearly, this is much better than having no 2nd factor at all, but the use of a phone number is known to be extremely insecure due to the SIM swap attack. Basically, it turns out to be surprisingly easy for an attacker to call your phone company, pretend they are you, and get them to switch your phone number over to a new phone that they control. I know this sounds totally crazy but it is true, and I have many friends who are victims of this attack. Therefore, purchase and set up hardware security keys - the industrial strength protection standard. In particular, I like and use YubiKey. These devices generate and store a private key on the device secure element itself, so the private key is never materialized on a suspiciously general purpose computing device like your laptop. Once you set these up, an attacker will not only need to know your password, but have physical possession of your security key to log in to a service. Your risk of getting pwned has just decreased by about 1000X. Purchase and set up 2-3 keys and store them in different physical locations to prevent lockout should you physically lose one of the keys. The security keys support a few authentication methods. Look for "U2F" in the 2nd factor settings of your service as the strongest protection. E.g. Google and 1Password support it. Fallback on "TOTP" if you have to, and note that your YubiKeys can store TOTP private keys, so you can use the YubiKey Authenticator app to access them easily through NFC by touching your key to the phone to get your pin when logging in. This is significantly better than storing TOTP private keys on other (software) authenticator apps, because again you should not trust general purpose computing devices. It is beyond the scope of this post to go into full detail, but basically I strongly recommend the use of 2-3 YubiKeys to dramatically strengthen your digital security.

Biometrics. Biometrics are the third common authentication factor ("something you are"). E.g. if you're on iOS I recommend setting up FaceID basically everywhere, e.g. to access the 1Password app and such.

Security questions. Dinosaur businesses are obsessed with the idea of security questions like "what is your mother's maidan name?", and force you to set them up from time to time. Clearly, these are in the category of "something you know" so they are basically passwords, but conveniently for scammers, they are easy to research out on the open internet and you should refuse any prompts to participate in this ridiculous "security" exercise. Instead, treat security questions like passwords, generate random answers to random questions, and store them in your 1Password along with your passwords.

Disk encryption. Always ensure that your computers use disk encryption. For example, on Macs this total no-brainer feature is called "File Vault". This feature ensures that if your computer gets stolen, an attacker won't be able to get the hard disk and go to town on all your data.

Internet of Things. More like @internetofshit. Whenever possible, avoid "smart" devices, which are essentially incredibly insecure, internet-connected computers that gather tons of data, get hacked all the time, and that people willingly place into their homes. These things have microphones, and they routinely send data back to the mothership for analytics and to "improve customer experience" lol ok. As an example, in my younger and naive years I once purchased a CO2 monitor from China that demanded to know everything about me and my precise physical location before it would tell me the amount of CO2 in my room. These devices are a huge and very common attack surface on your privacy and security and should be avoided.

Messaging. I recommend Signal instead of text messages because it end-to-end encrypts all your communications. In addition, it does not store metadata like many other apps do (e.g. iMessage, WhatsApp). Turn on disappearing messages (e.g. 90 days default is good). In my experience they are an information vulnerability with no significant upside.

Browser. I recommend Brave browser, which is a privacy-first browser based on Chromium. That means that basically all Chrome extensions work out of the box and the browser feels like Chrome, but without Google having front row seats to your entire digital life.

Search engine. I recommend Brave search, which you can set up as your default in the browser settings. Brave Search is a privacy-first search engine with its own index, unlike e.g. Duck Duck Go which basically a nice skin for Bing, and is forced into weird partnerships with Microsoft that compromise user privacy. As with all services on this list, I pay $3/mo for Brave Premium because I prefer to be the customer, not the product in my digital life. I find that empirically, about 95% of my search engine queries are super simple website lookups, with the search engine basically acting as a tiny DNS. And if you're not finding what you're looking for, fallback to Google by just prepending "!g" to your search query, which will redirect it to Google.

Credit cards. Mint new, unique credit cards per merchant. There is no need to use one credit card on many services. This allows them to "link up" your purchasing across different services, and additionally it opens you up to credit card fraud because the services might leak your credit card number. I like and use privacy dot com to mint new credit cards for every single transaction or merchant. You get a nice interface for all your spending and notifications for each swipe. You can also set limits on each credit card (e.g. $50/month etc.), which dramatically decreases the risk of being charged more than you expect. Additionally, with a privacy dot com card you get to enter totally random information for your name and address when filling out billing information. This is huge, because there is simply no need and totally crazy that random internet merchants should be given your physical address. Which brings me to...

Address. There is no need to give out your physical address to the majority of random services and merchants on the internet. Use a virtual mail service. I currently use Earth Class Mail but tbh I'm a bit embarrassed by that and I'm looking to switch to Virtual Post Mail due to its much strong commitments to privacy, security, and its ownership structure and reputation. In any case, you get an address you can give out, they receive your mail, they scan it and digitize it, they have an app for you to quickly see it, and you can decide what to do with it (e.g. shred, forward, etc.). Not only do you gain security and privacy but also quite a bit of convenience.

Email. I still use gmail just due to sheer convenience, but I've started to partially use Proton Mail as well. And while we're on email, a few more thoughts. Never click on any link inside any email you receive. Email addresses are extremely easy to spoof and you can never be guaranteed that the email you got is a phishing email from a scammer. Instead, I manually navigate to any service of interest and log in from there. In addition, disable image loading by default in your email's settings. If you get an email that requires you to see images, you can click on "show images" to see them and it's not a big deal at all. This is important because many services use embedded images to track you - they hide information inside the image URL you get, so when your email client loads the image, they can see that you opened the email. There's just no need for that. Additionally, confusing images are one way scammers hide information to avoid being filtered by email servers as scam / spam.

VPN. If you wish to hide your IP/location to services, you can do so via VPN indirection. I recommend Mullvad VPN. I keep VPN off by default, but enable it selectively when I'm dealing with services I trust less and want more protection from.

DNS-based blocker. You can block ads by blocking entire domains at the DNS level. I like and use NextDNS, which blocks all kinds of ads and trackers. For more advanced users who like to tinker, pi-hole is the physical alternative.

Network monitor. I like and use The Little Snitch, which I have installed and running on my MacBook. This lets you see which apps are communicating, how much data and when, so you can keep track of what apps on your computer "call home" and how often. Any app that communicates too much is sus, and should potentially be uninstalled if you don't expect the traffic.

I just want to live a secure digital life and establish harmonious relationships with products and services that leak only the necessary information. And I wish to pay for the software I use so that incentives are aligned and so that I am the customer. This is not trivial, but it is possible to approach with some determination and discipline.

Finally, what's not on the list. I mostly still use Gmail + Gsuite because it's just too convenient and pervasive. I also use 𝕏 instead of something exotic (e.g. Mastodon), trading off sovereignty for convenience. I don't use a VoIP burner phone service (e.g. MySudo) but I am interested in it. I don't really mint new/unique email addresses but I want to. The journey continues. Let me know if there are other digital hygiene tips and tricks that should be on this list.

Link to blog post version in the reply, on my brand new Bear ʕ•ᴥ•ʔ blog cute 👇

[indigo @indigox]

培根曾说：“阅读使人充实，交谈使人机敏，写作使人精确。” 尽管培根的时代与现在截然不同，但这句话的真理却依然闪耀。写作之所以重要，不仅仅因为它能记录我们的想法，更因为它是一种发现和锤炼思想的独特方式。通过写作，我们得以深入思考，超越表面的理解！- 引用自 https://t.co/dwdY1ha4iI

[LangChain @LangChain]

Open Deep Research

Deep research is one of the most popular agent use-cases. Here is an open deep researcher w/ ability to configure report structure, planner/writer LLMs, search APIs, search depth, etc.

📽️
https://t.co/r6YhwjRErx

Code:
https://t.co/fTkEHieaJi

[宝玉 @dotey]

转：关于 DeepSeek 的研究和思考 (Archerman Capital)

关于这几天很火的 DeepSeek, 我们 (Archerman Capital) 做了一些研究和思考, 和大家分享, enjoy! 灰色部分是技术细节, 不感兴趣的可略过。

几个事实

1) DeepSeek 不是套壳不是蒸馏美国的大模型。 虽然中国有些大模型是套壳和蒸馏的, 但 DeepSeek 不是。

2) 核心架构还是基于 Transformer, deepseek 在架构、工程设计上进行了创新和工艺提升, 实现效率优化。架构上, 采用了混合专家模型 (MoE)、多头潜注意力 (MLA)、多令牌预测 (MTP)、长链式推理 (CoT)、DualPipe 算法等设计, 并进行了依赖强化学习 (RL) 而不加入监督微调 (SFT) 的训练尝试。工程上, 在数据精度 (FP8 混合精度)、底层通信等方面进行了优化。这些方法在学术界都已经有了, Deepseek 没有过于追求新技术, 而是花了心思把这些方法都用上, 解决了一些技术的应用难点, 在理论应用和工程上找到平衡, 具体如下:

MoE: Mixture of Experts (混合专家模型)。将模型划分多个专家模块来进行分工。训练中将不同专家模块分配到不同计算设备训练, 提升训练效率。推理时, 仅动态激活部分专家 (37B 参数), 而非全模型参数 (671B 参数), 减少计算负担。但是 MoE 经常会面临某些专家承担所有工作, 其他专家不被使用的问题, 业内会通过一如辅助损失来对此调控、平衡各个专家模块的工作量, 而 deepseek 通过无辅助损失的自然负载均衡 (引入一个无形的手而不是人为调控)、共享专家机制来解决该问题。

MLA: Multi-Head Latent Attention (多头潜注意力)。扩展了传统的多头注意力机制, 引入潜向量 (latent variables), 可以动态调整注意力机制, 捕捉任务中不同的隐含语义。在训练中减少内存和计算开销, 在推理中降低 KV 缓存占用空间。

MTP: Multi-Token Prediction (多令牌预测)。一般 LLM 一次生成 1 个 token, 采用单步预测。deepseek 在特定场景下能同时预测多个 token, 来提高信号密度。一方面能够减少上下文漂移、逻辑更连贯, 也能减少一些重复中间步骤, 在数学、代码和文本摘要场景能提升效率。

CoT: Chain of thought (思维链)。一种训练和推理方法, 将复杂的问题拆分成小步的中间逻辑, 细分逻辑链条。在训练阶段, Deepseek 用标注的 Long CoT 数据微调模型, 让模型生成更清晰的推理步骤, 在强化学习中用 CoT 设计奖励优化, 增强长链推理能力, 并且在此过程中观察到了模型的反思 (回溯推理路径)、多路径推理 (能给出多个解)、aha 时刻 (通过策略突破瓶颈) 等自发行为。

DualPipe (双重流水线): 传统训练信息流水线会产生一些等待时间、有“流水线气泡”, deepseek 设计了一个双重流水线, 让一个计算阶段在等待数据传输时可以切换到另一批数据, 充分利用空闲时间。

R1-Zero: Deepseek 在 V3 基础模型上, 仅通过强化学习 (Reinforcement Learning) 训练, 而不加入 SFT (Supervised fine tuning) 数据, 训练了 R1-Zero 模型, 探索了模型不依赖人类标注数据微调、自主推演的能力, 打开了新的思路。但 R1 模型仍然采取 SFT 数据优化推理和生成质量。

FP8 混合精度训练: 引入了 FP8 混合精度训练框架, 相比传统的 FP16 精度, 数据内存占用更少, 但在一些算子模块、权重中仍然保留了 FP16、FP32 的精度, 节省计算资源。

底层通信优化: 开发了高效的通信内核, 优化对带宽的利用, 保证数据传输效率, 并能支持大规模部署。

拿内燃机和汽车的发明打个比方, 德国人发明了内燃机和汽车, 美国人喜欢 Scaling Law, 排量越大马力越大, 于是从 2 升到 4 升, 甚至 8 升排量的车在美国都很常见, 所以美国肌肉车很耗油。虽然源头技术不是日本发明的, 但日本人擅长把一件事做精, 工程上做很多优化, 日本 2.5 升排量的车甚至可以做到和美国 5 升排量车一样的百公里加速指标。比如轻量化设计把大钢板换成钢条 (类似通过稀疏的办法减少大模型的参数量); 涡轮增压利用废气能量增加空气供给, 提高燃烧效率; 精密制造, 使得发动机零部件的配合更加紧密, 从而减少能量损失; 等等。

3) 有些宣传说 DeepSeek 的训练成本是 550 万美元, 是 Meta 的 1/10, OpenAI 的 1/20, 好像一下子比别人厉害了 10 倍 20 倍, 这有点夸张。 因为现在在美国预训练几千亿参数的一个模型其实也到不到 2000 万美元的成本, DeepSeek 把成本差不多压缩到三分之一。Meta 和 OpenAl 花的钱多是因为前沿探路, 探路就意味着会有浪费, 而后发追赶是站在别人的肩膀上, 是可以避开很多浪费的。另外算力成本在过去几年是指数型下降的, 不能这么机械的比较。打个不恰当的比方, 创新药的研发需要十年几十亿美元, 而仿制药的研发一定会更快更省。另外成本的统计口径也没有统一的标准, 可以有很大的差别。

几个观点:

1) DeepSeek 代表的是整个开源相对闭源的一次胜利, 对社区的贡献会快速转化为整个开源社区的繁荣, 我相信包括 Meta 在内的开源力量, 会在此基础上进一步发展开源模型, 开源就是一个众人拾柴火焰高的事情。

2) OpenAl 这种大力出奇迹的路径暂时看显得有点简单粗暴, 但也不排除到了一定的量又出现了新的质变, 那闭源和开源又将拉开差距, 这也不好说。从 AI 过去 70 年发展的历史经验来看算力至关重要, 未来可能依然是。

3) DeepSeek 让开源模型和闭源模型一样好, 并且效率还更高, 花钱买 OpenAI 的 API 的必要性降低了, 私有部署和自主微调会为下游应用提供更大的发展空间, 未来一两年, 大概率将见证更丰富的推理芯片产品, 更繁荣的 LLM 应用生态。

4) 基础大模型终将 commoditize (商品化), toB 领域看谁能将 LLM 更好和复杂的生产环节衔接好帮客户落地提高生产效率, toC 领域看谁有流量入口, 最终才会获取 AI 产业价值创造中最多的利润。

5) 对算力的需求不会下降, 有个 Jevons 悖论讲的是第一次工业革命期间蒸汽机效率的提高使得市场上煤炭的消耗总量反而增加了。类似从大哥大年代到诺基亚手机普及的年代, 正因为便宜了所以才能普及, 因为普及了所以市场总消费量增加了的。

6) 对数据的需求不会降低, 巧妇难成无米之炊, 没有米怎么做饭, 算法的提高相当于做饭吃饭变得更快, 对数据的渴求会更大。

研究期间, 我们与几位学术界和工业界的专家进行了交流, 由于尚未获得公开提名的许可, 就暂不提及具体姓名了, 但在此特别表达感谢! Archerman Capital™ 是一家美国的成长期股权投资机构, 专注于人工智能、数据基础设施、网络安全等领域的成长期投资。其投资组合包括 Databricks, Scale AI, Tenstorrent 等。该机构采用高度研究驱动和第一性原理的方法。公司总部位于波士顿, 在纽约和硅谷设有投资团队。以上是纯分享, 并非投资建议。