aforwardslash

Yesterday I maxed out my second 20x Max account; I routinely work on 5-10 projects at once with different degreees of maturity. Im pretty sure I could max out 4 accounts if I had the budget :D

I started using it last week, the tui interface is very polished and it is mouse-friendly. It also allows you to configure the notification channels. Its a different beast from tmox, I'd say its quite more user-friendly and gives you a list of your running agents and their status directly on the interface.

AHA true :D

Not the topic (the site is interesting), but a tangential rant.

I think the whole CVE/CVSS system is completely outdated, and it doesn't reflect the reality of software making for a while now (years). Also. for years, major software providers have been fighting to control their own release logs and security vulnerabilities. Recently, NIST stopped actually analyzing CVE's (one can relate to that), and the fact is that the system only makes sense as 1) vuln database; 2) in the context of responsible discosure; Responsible disclosure is from a non-AI era, where the time between a finding and a release woulds be measured in months, not weeks. Also, from a time where the probability of another human to stumble on that specific vulnerability was quite low. Pre-AI times.

Also, in April 2025 MITRE announced that fundings to the CVE/CWE program would expire, and it took a couple of days for the Trump administration to backpedal from that. We need a global system, not an american one - and clearly, americans should not be in charge of these global programs, as there is no way to isolate the world from their local politics. Their programs, their funding, nothing against it. I just think we, collectively, should have something a bit more robust, and while at it, do it on a quite more modern basis (EU CRA is actually a good start, as it includes SBOM and mandatory reporting).

CVE, CVSS, CPE seem all designed by comittee; CVSS and CPE are a flagrant case of that (try to apply CPE versioning to your own software, you'll get it); Its "what we have now" - there are alternatives, afaik but not that mainstream.

Totally agree. But most products aren't innovative. Currently in IT, the most innovative product its actually the LLM. You know who else sucks at writing greenfield code? Hunans.

Does the essay compile? And if not, will it iterate until it does?

By now, is your Markov chain still a Markov chain, or does it have another name?

People love to discuss semantics. Yes, *today* a competent product manager enters requirements and - if not too complex - the llm will shit, review, debug, fix an application. That is the reality today. Not in 2031.

Only developers think that in most cases, the hard part is code. Its never been.

Thats actually exactly on point; thing is, are programs deterministic? It depends; one can argue that any speculative execution pipeline cannot be truely deterministic from a timing perspective; its not an issue for a compiler, but it is for many applications. Gcc optimization flags were notorious to expose both compiler defects and non-deterministic code.

An LLM is a stochacstic system. With enough rounds, its undistinguishable from an emulated deterministic one, if you consider a delta greater than zero. Oh and each implementation/iteration give you the same determinism guarantees :)

Is this an article about retro future? Because this is basically part of my work reality. I sincerely hope not to have to review pr's in 2031.

Only if the emulator emulates the timings faithfully; Also it probably needs to emulate the dma/rmt subsystem at a timing level.

Vaguely related, I recently designed a ws28x emulator (a physical device with support upto 1024*4 led stripes) to test firmware of our own devices. Ill probably make it oss when we release our system.

Have you done a google search recently? The response time beats any anthopic or openai stuff, by an order of magnitude. They already are.

> OpenAI and Anthropic are AI business

Technically, they arent even a business. One is a business when the revenue model works. People in IT tend to forget that.

They havent. OpenAI and Antropic are now integrating with a plethora of apps, google has it from the get-go. Also, it may be important to point out that the transformer model (aka the hole llm thing) is a google initiative; Id assume they are not competing in the qualification series of AI (which is lets build a generic ai and get customers), but in the finals - they already have the customer base and the lock-in, they don't need to scale - just to cater. Cerebras and Google are probably the best safe bets in AI right now, and google does gave the tradition of being way ahead of the curve internally vs what is published.

Very happy for you! Maybe I wasn't clear, Im quite better now thanks to surgery - still, because some damage is irreversible, I have nerve damage that creates a whole new set of problems; In my case, what the surgeon did was almost short of a miracle, given the state of my hernias. He would also agree with this assessment, btw; these things, in the state I was, usually end up much worse.

I wasn't able to read the full article because of the paywall, but as someone who had back surgery and live with complications from it (mainly from spending a decade postponing going to a competent doctor to have a diagnosis and a healthy fear of hospitals - don't be me, if you feel regular back pain or if you sometimes feel back pain that is incapacitating, seek proper medical care - things tend to degrade, and I'm actually quite lucky I'm not in a wheelchair, not kidding) I think I'm entitled to say a thing or two:

We have a statistics problem. Thing is, the way successful surgeries vs botched procedures are measured isn't transparent; as an example, my mother died 2 years ago victim to a routine procedure; It was a combination of both "bad luck" (something went wrong with the procedure) with laxity (prolonged weekend, nobody cared about complaints). Because she didn't died on the table, instead from "complications in recovery" (fyi they accidentally perfurated the intestine during the procedure), its "natural causes".

Many years ago, my dad died from meningitis, 8-10 months after a surgery and a very long recovery. I'd bet a couple of fingers it was a hospital-contracted infection during either the surgery or the recovery. Again, a routine surgery took 8h instead of the expected 2.5-3h. Shit happens, we know - surgery is extremely dangerous, and there is a shit ton of stuff that can go wrong.

Thing is, none of this get into the statistics; There are no reliable survival metrics; The papers you sign are riddled with medical terms to isolate you from the consequences (would you do a non-critical surgery if you could end up shitting on a stomach bag for the rest of your life?), and many many doctors are quite happy into "selling you" their trade option. To be clear, the number any doctor presents you is *wrong*; it has no connection with reality; failure rates measure deaths on the table (the best kind of death, btw), and studies extrapolate from badly measured (per-hospital metrics) or non-existing data.

Tl,DR: avoid surgery if you can; If you really need it (after asking for at least 2 more opinions), your health (and often life choices) matter - bad kidneys, weak liver, etc may be the difference between someone rushing it up or giving an extra 20 min to ensure everything is kosher.

This. Even if you're struggling with pain after surgery, moderate activity, a well regulated diet (to control inflammation) and stress management can do wonders. I know from experience :p

Id argue by an order of magnitude. Knobs require cables, connectors and assembly; they also require dedicated robots and/or a human to test them in the assembly line.

Well, on a different note, if you have a scripted language application, you typically can edit files and bypass whatever you want on the application. In fact, I'd bet most modern software isn't signed; and even if it is, sometimes the libraries that get compiled in into that signed binary... aren't.

I can change the behaviour of many/most applications by just having read/write access to files; Can you give me examples of mainstream applications that are resistant to filesystem tampering when eg.you have install access? Maybe I'm missing something.

I for one welcome our AI overlords :D think about it, I'm with you on this one; an AI wont have petty issues or unresolved trauma when managing people, only hallucinations and blackouts. So a cocaine/meth addicted 80's boss from an it sitcom.

They already do. Llm is just an algorithm. Dont worry, you've been lied to algorithmically at least since the 90's.

Who is nobody? At least a fourth of the worlds work force works for a faceless corporation. And the math on emissions is crystal clear, no one has any doubt about it, what are you talking about? USA and China. This obviously will have consequences to their customers, the kumbaya politics governments.

You can run doom on anything these days; running it on humanity's eulogy is no surprise :)

Sort of. Today the energy companies trade (obviously) energy; imagine if they traded compute power instead; the use case for never-seen industrial clients is being built as we speak, and companies are actually purchasing directly production companies to meet demand; the reason this happens is because production is somewhat scarce (scaling up a grid used to be a decades project, not a years one - ask China), and the traditional economics of scale is inverted - Data centers are always power-hungry, specially with AI; you don't have idle time like other industries. The big issue is obviously the scale - a hiccup that causes a dc to go dark from the grid (eg switching to ups+ generator) may cause such instability on the grid that it will shut down, as a safeguard

It has been for a decade now, it has nothing to do with AI. And you cant do nothing to avoid it today. This is the reality no one is telling you - the emission goals and global temperature ceilings are based on the fact that most prediction models become unstable with values above those limits; as in, we're probably royally fucked. You cant solve this with kumbaya politics (the problem is the CO2 is already in the planetary system), you can only manage it, and hopefully avoid it getting worse. AI may help a lot with this.

Apparently is for some people. Not sure why.

You add yourself to the docker group to be able to use the socket. By default, a uid 0 on a docker container is run as root, regardless of the uid of the owner of the container. That is precisely the issue being discussed.

Im not particularly fan of the chinese, but no chinese model asked for my citizen card yet to complete a task. And apparently no chinese provider uses persona to manage this kyc information. OpenAI does, in EU space. Just saying.

On that topic, check higgsfield cinema studio 4; they already provide amazing tech for the cinematic experience, somewhat similar to what you are describing.

LLMs will certainly replace most developers. Most developers dont know that "computer" was a profession not long ago (and a quite demanding one).

You are conflating "not understanding how to build software" with "not knowing how to write code". Most developers I've crossed paths with couldn't build a consistent library, let alone a complete, well written, architecturally sound and useful application. Sure, I also know plenty that don't fall into that category but those are the few.

Problems with deploy? Ask claude, use ssh with key-based auth and he will take care of it :) just saying.

I've been writing code "almost daily" for the last 35 years; been doing it professionally for at least 29 years. I've been around, and my peers consider me a proficient developer. I've built stuff ranging from embedded/os level development to DSL languages, from 3D programming to VBA macros. I wrote software used by me, and wrote software used by millions. In some cases, I've maintained products written by me nore than a decade. By your definition, I must be wrong, truth is I can afford to be wrong - my job is not writing code, is designing solutions. Writing code is often the easiest part, and we're mostly automating it. Thank god.

As someone diagnosed recently, I can confirm this. People think it is a linear set of symptoms/traits, and not a bouquet of clues. Disclaimer: I previously was one of those people, and I typically dont give a rats ass on what people think :)

Im developing something vaguely in the same space (tamper proof audit log) - (or several things since I also have a custom temporal object mapper for postgres); what is the advantage of this project? It doesnt seem sql-compliant (afaik bitemporal operations are part of the SQL-2011 standard), and what this could add -tamper detection - seems absent. Not criticizing, just trying to understand the use case.