MeetingsBrowser

> logic based vulnerabilities like a ReDoS pattern identified from source without live exploitation, or an admin-only route that's never been exercised

The two classes of vulnerability given as examples are the exact kind of issue I probably don’t care about, and are not grounded in an actual security model

I don’t know how to make the statistics match my perceived reality.

Both in this thread, and people I know in real life who are looking for jobs are struggling hard. Mass layoffs are becoming more common and the time spent between jobs is measured in six month increments.

And yet, the numbers say we are in a hiring market with more job openings than ever, except for during the pandemic.

My perceived reality and the numbers almost could not be further apart.

The proposed solution conflicts with the supposed problem.

The author is an individual claiming the ability to author and maintain a standard library

… to be used by small orgs who do not have the resources to author and maintain a standard library.

This is a collection of forked open source crates bundled together with open model vibe coding?

> the code written by AI is more robust than by humans because more edge cases are tested.

This is at least a mildly concerning take to see in a blog post announcing a solution to supply chain security.

It seems like this boils down to: don’t trust the original authors to maintain the packages they wrote, trust me and my LLM instead.

What is the benefit of switching memory modes like this?

Recipes go back millennia, and seasonings were also common, but varied by region. It’s easy to grow your own herbs a, or even forage for some things.

I don’t think it’s true that most food sucked at any point, except for people in exceptional circumstances.

What project did you apply for?

I wonder how the estimates are being created.

I doubt an LLM would estimate an AWS rewrite to cost $500.

> Build a completely greenroom, open source AWS

> est. total target $516.00

Lol

What do you use instead?

strict type checking is an incredibly useful tool for cases when you really want to make sure your code is correct and behaving as expected (one of many tools).

There are lots of people who like python and want to use it for things that where incorrect code has serious consequences. Type checking is helpful in these contexts.

Type checking remains optional for the masses and is not practical in many cases. Still, pushing away people who want to use all available tools for writing correct python only hurts the community.

Only juniors are suing VSCode? What are others using?

claude code is developed by a large team of people being paid among the highest salaries in the industry. ~$500-750k/year according to levels.fyi

I wouldn't count that as evidence that AI tooling makes it easy to build useful software without much effort.

> Have you tried it?

I've used agentic tooling at work for almost a year now, to great affect.

Tools are helpful, but in my experience they are not to a point where building things useful software is easy or simple.

Most of the things I have seen or heard described are neat demos that someone might play with a few times before forgetting about.

Of the projects you mentioned above, how long did you spend building them relative to how long they've been regularly used? Are you using them on a regular basis? If so, are they published somewhere for other people to use as well?

I see this sentiment constantly. AI tooling is better than ever and its making building things easier than ever. I have respected coworkers who say that are maxing out multiple $200/month subscriptions.

But I have yet to see any results? Where is the useful stuff?

DDG has been my daily driver for more than a decade now and I could not be more pleased.

Better privacy, good results, no drama, first search engine to include bangs, and its free!

Your reasoning implies that specific people within an org are not getting raises, but in practice it is entire orgs going without raises or promotions, regardless of what any individual is doing.

$100k is probably at the top end. Even at Cloudflare, interns are more likely to be making $25-40/hour according to levels.fyi, which works out to $52-83k.

I've used agents quite a bit and I agree.

The current baseline workflow is something like agent output -> human review -> agent refinement -> human review -> agent refinement -> ...

But agents are capable of making meaningful improvements to their own output. I'm hoping dynamic workflows move towards something like:

agent output -> agent review -> agent refinement -> (cycle to fixed point) -> final human review

It would be cool to see the distribution of all player scores.

> I think all funding in California education (other than terminal levels like 4 year bachelors and up) should be a function of the percentage of students that succeed at the next step.

This seems problematic.

Students' success isn't entirely up to the school. Some areas genuinely need more resources than others.

This system punishes areas that need more resources with by removing resources, likely causing a downward spiral.

A generation of kids is left with poor education before the schools eventually close, and then who wants to start a school in an area that has historically struggled when funding depends on them succeeding?

Based on happenings in other states, when public schools close the schools that take their place are from well funded groups who care more about spreading ideologies than running successful or profitable schools.

I think we may be talking past each other at this point, but secrets from a dev env can be more valuable than secrets from a production env.

With things necessary for a dev env, like read/write access to source control, attackers can get access to internal data, and push malicious code that gets run in a prod env anyway.

If you want to make the claim that using react is an insane indefensible choice from a security standpoint, you are being idealistic at best.

Telling people not to use react does not help anyone, and that type of recommendation causes reputational damage to the security industry.

> There is 100% benefit in running that shit in a development environment.

Most of the recent supply chain attacks specifically target stealing secrets from development environments.

> But hey thanks for proving me right about the unhinged complaints.

I'm sorry if I'm upsetting you, but I am not complaining or trying to provoke you.

"Just check in the dependencies and review them" is not a revolutionary idea. It makes sense in many contexts.

But it is not practical in the overwhelming majority of contexts. React's last minor version bump included 100 files and ~5k changes. It also bumped the versions of 6 direct dependencies, which in turn bumped dependencies, etc.

It is not reasonable for a small (or even medium) team using react to manually review all of the changes and all the changes in react's transitive deps each time they need to update. The problem grows exponentially with all of the other common projects and libraries likely being used in a front end project(vite, react router, redux, vitest, etc).

pick a few non-trivial npm projects and try to audit all of the changes (for all transitive dependencies) for a few releases that bumped dependencies.

The blog post does want to share some type information with users. They just want to prevent users from relying on a specific implementation of that type.

They are basically describing a public API backed by a private type that they can extend, rearrange, or otherwise modify without breaking the public contract.

If the AI overview produces plausible sound answers, how do you know that it messes up very rarely?

If I search topics I am knowledge about, the overviews are almost always at least slightly wrong.

Not all websites are correct sources of information, but I am generally aware of which websites are trustworthy and can cross check.

I noticed if you change to the “all time” view it shows a steady linear growth, with no big spikes or valleys.

Copy/pasting source code doesn't solve either of those problems either.

If you already had left pad cached then you were not affected by its disappearance.

If a package needs an install script to be used, to compile some native code for example, you still need to run the install script before you can use the package.

Manually repeating the actions npm does automatically does nothing to protect you from supply chain attacks.

The only thing that helps is to review code before you run it. How the code got to your machine before it was run does not matter.

What are the benefits of moving from Go to Zig?

It seems like you lose a lot (automatic memory safety, simple language, easy concurrency) and gain very little.

Indirect evidence, but parts of AWS and cloudflare have been running Rust in production for close to a decade now and neither company looks to be itching to move services back to Java.

It totally works, but only if you manually review every change in every dependency and transitive dependency you rely on.

If you blindly copy in changes how is it any different from npm pulling in those same changes, other than being much slower?