beardedwizard

+1, I think you have to assume owned as well and start defending from there. Companies like edera are betting on that, but sandbox isn't panacea, you really need some way to know expected behavior.

The bummer about lots of supply chain work is that it does not address the attacks we see in the wild like xz where malicious code was added at the source, and attested all the way through.

There are gains to be had through these approaches, like inventory, but nobody has a good approach to stopping malicious code entering the ecosystem through the front door and attackers find this much easier than tampering with artifacts after the fact.

But this is the solution the most cutting edge llm research has yielded, how do you explain that? Are they just willfully ignorant at OpenAI and anthropic? If fine tuning is the answer why aren't the best doing it?

But copilot is bundled and is free, and it's still losing to cursor

Bitbucket is not a player, as you said there are only people leaving. Gitlab has a better enterprise posture than GitHub and can be deployed more securely. Most developers aren't unhappy with GitHub, but IT and security teams are.

Why gitlab hasn't been able to capitalize on GitHub's many failures is almost as interesting as GitHub's fall.

I think the GitHub brand is still stronger and people just don't "care" about gitlab.

It's a close call - I make this based on the fact that GitHub is viewed as an anti-choice by some in the community, a huge change from the "you don't use GitHub?!?!" energy they had pre-acquisition.

The MS acquisition traded the developer community to briefly appeal to enterprises, then quickly let both down.

GitHub has been failing upward for more than 5 years. They could have totally dominated software development and security - failed. Could have been the undisputed champion of code hosting - failed. Should have dominated development co-pilots - failed.

I actually find it a little reassuring that they can't seem to get out of their own way.

I'm a big supporter of NPR but you don't need to look hard to see their progressive bias.

Project 2025 would be the most obvious answer

Perhaps, but the simplest answer is often the correct one. People are exactly who they appear to be.

They are using unofficial comms to stay off the record and unaccountable, it has nothing to do with ease of use.

Jails have been around longer, but I'm not sure how much it really matters. Jails and containers both share the kernel across workloads. A kernel exploit is generally accepted as the barrier to break out (and of course implementation bugs). VMs don't share kernels across workloads, but do share a hypervisor which can also have breakout bugs. Both jails and containers depend on the kernel to be bug free.

VMs (depending on hypervisor) are easier to secure by default, you can't easily forget an overlay fs, or make other mistakes that expose some part of the host to containers.

[flagged]

Do you feel better about naked self interest and blatant corruption after you say that?

Does it make it ok because you try to equivocate?

Is it so hard to just say "corruption is bad all the time and we should not tolerate it from anyone" - it is not a controversial position at all.

The trick to competing with Duolingo is to _actually_ teach people new languages that they actually learn, rather than giving away the illusion that they are learning a new language on Duolingo.

Where are the goalposts then? If the answer is always "you are prompting it wrong" then there are no goalposts for agentic development.

Where is the consensus position that is demonstrably more effective than traditional development?

My observation is that it's somewhere close to "start this project and set an overall structure", after that nobody seems to agree.

That's the same analogy anthropic uses to describe it.

It still smashed the bread quite a bit in the demo video, the difference wasn't super obvious until they held the loaf up. I wonder how representative that demonstration is, because the text mentions a combination of moving blade and food platform.

Your last sentence makes me think we agree. In my experience employees perceive they have much more to lose from transparency. If they are low agency, not actively bad and defer when asked what they want, you may be surprised when they finally quit.

You make it sound like employees are perfect and communicate transparently at all times. Many people lack the ability to be self critical and want to avoid confrontation. That often leads to surprises, a managers worst friend.

How did you get started consulting? I'm in a similar spot, been a director, don't really want to go back to it.

I agree - and also the fact that cursor even exists while Microsoft had already built copilot.

I think I understand this comment but can you expand on how cursor defines this dilemma?

I would definitely agree with that.

I'm sure you didn't miss the point on purpose - the parent made a silly claim implying US healthcare was uniquely bad when the truth is both approaches have huge problems. In the US you can get care any time, as long as you can afford it. You might die if you are poor. In many other countries care is free or cheap but you may die waiting.

That's great, maybe the wait times for an appointment will be 60 days instead of 6 months in some of those places.

Those systems already exist and they are not llm scribes. Check out nant health eviti, and others.

I noticed the same thing, very strange.

How long will California maintain GDP dominance when major parts of business are in the pocket of Trump? Won't they just pack up and leave, tanking Californias economy with it?