381 karma · joined March 23, 2026
The fact is that your dependencies are your responsibility. You should be staying up to date on what you depend on and their vulnerabilities. Most vulnerabilities affect specific code paths which may not be present in your code base and do not require mitigation. These are decisions you can make by understanding what your dependencies are instead of offloading to automated package management systems.
NPM has been the posterchild of these types of issues but the dependency stack I saw everytime I compiled even simple programs in Rust made me think Rust would be impacted next. Personally I think third party modules that are effectively universally used (axum, tokio, serde) should be integrated directly into the language.
I recently listened to the Hammock Driven Development talk (https://www.youtube.com/watch?v=f84n5oFoZBc) and it raises the very interesting point that it's not really the concious mind that makes big breakthroughs on hard problems, it's mainly the subconcious mind synthesizing information. It seems obvious to me that constantly intaking information will ruin this synthesization.
Sadly for some reason our brain loves filling the silence with junk...
>In fact, I strongly suspect that i am merely a statistical machine picking words from a learned distribution.
This is a completely incoherent statement (which maybe supports your point). How can you suspect that you are a statistical machine? The fact that there is a "you" suspecting disproves the premise.
Overall LLMs are certainly a net negative on humanity, but I don’t think being mad about it or their users is the best response. I really respect Andrew Kelly in this regard. He doesn’t accept LLM input into Zig and is generally anti-LLM but his approach is positive. “LLMs aren’t that good and it’s boring to use them. Check out how cool/fun/high quality real coding is”
I’m trying to minimize my use of LLMs because I think they are harmful personally but I don’t get mad at people that use them (unless they are just spamming slop but then I just ignore it)
Personally I think Andrew Kelly’s take is the best. Basically not interested in LLMs but if someone uses them to do something cool then cool I guess?
Agentic engineering is probably not helping since it tends to accelerate growth of LOC. I also personally think quality is an issue as well but it could be a skill issue on my end idk.