bjackman

My extremely non-technical mum is using a 2008 MacBook Air on Ubuntu, it works great. Claude says the iMac is essentially the same to get running.

Only hassle was setting up the Broadcom WiFi drivers which aren't upstream, but I did this before I would have trusted AI with this task and even then it was not a big deal. I think these days running Linux on those things is likely trivial.

You can also just run Bitmagmet for a few weeks and then you have your own tracker. (I think "tracker" might be technically incorrect jargon but it solves the same problem).

The thing that defeats your point is that there is no consequential C codebase that has dynamic allocation and no UAF. There simply isn't an argument to be had here, it's an empirical question and it's settled. It's time to move on and adopt memory safe languages. There are no valid excuses any more now that Rust is basically tolerable.

If you wanna claim this is a skill issue and you are built different etc, fine. I guess we can just say C is fundamentally unsafe for _everyone except you_.

(This is like when people wanna argue about if self driving cars are safe or not and they're blathering on about technical capabilities and limitations. No. We have the data).

Sorry but no, this is totally wrong. There is no set of compiler flags or design practices that can fix the lack of lifetime analysis in C.

I do actually think that with modern C++ it's possible to get to a style of programming where memory unsafety is mostly a theoretical concern but not with C.

I do tend to think people under use bitfields.

I suspect this is because they are usually introduced like "here are bitfields, but DO NOT USE THEM for anything that might become ABI because their order is implementation defined". I think that causes people to mentally file it under <sketchy language features to avoid> when actually there are many contexts where the ABI risk is not real.

> Rowhammer says hi

Yeah I was thinking of prefixing my "memory corruption" with "software-bug induced"! I don't see a credible solution to Rowhammer. ("DDR[n+1] fixes it" - lol)

> an unsafe block, an FFI boundary

Honestly these feel solvable to me at this point! I think we'll see:

- unsafe code shrink as languages get more powerful

- amount of analysis we can apply to each unsafe line shoot up exponentially as AI gets cheaper

- amount of FFI we actually need shrink as it gets easier to just click "rewrite it in $lang" on the decision card when your coding agent says "I found a library for that but it's in a different language"

(Having said all of that, people seem to be adopting Zig for some bizarre reason... So maybe I'm naive to expect unsafe lines to shrink)

(But also, maybe AI gets so good and so cheap that we can just type "go fidn all the bugs andfi xthenm" into an LLM, between sips of a Piña Colada)

> This is not a substitute for a proper C tutorial

'bool' is still at least 1 byte in C. If you want to store one Boolean per bit you have to manually implement a bitmap.

It's beautiful to see this perspective! The fact that we are at "whoa, C is fucked up compared to my expectations" instead of "look at Rust's fancy safety stuff" shows that as a field we've started lifting the baseline.

Nowadays I actually believe I'll likely see a world without memory corruption within my lifetime.

Does anyone know what the play here is?

(Is it given that there's a play? Waymo is culturally a little distinct from Google so from personal experience I can't actually rule out that they're just doing this coz they think it would be good for the world).

I don't think it makes much sense to expect such a cohesive/specific philosophy from an open source project like this.

The goal is "Linux on Mac". In a commercial product, specific details of what gets built usually stem from a more detailed vision that can be articulated as one. In open source projects those details are determined by what individual contributors are motivated to work on.

That doesn't means a cohesive vision can't emerge, there might be one for Asahi actually. But I think the default position is that it's kinda just a mob of people doing what they each feel like doing.

I think LWN is not just the best linux news site or the best tech news site, or the best new site. I think it's actually the best website. I just can't think of anything else that comes close in terms of quality of information.

If you have any professional connection at all to Linux then $11/mo is an absolute bargain!

The Asahi folks have been making really impressive progress on Polishing Cloth drivers so I'm optimistic that we'll at least have a community solution for the E-waste in future decades.

> Is there any type of sidebar/footnote that you, as a reader, would like to see to denote AI usage during the writing and/or research process?

It's not something I expect, but I definitely don't see an issue with people putting a couple of sentences in an "expand to see AI usage notes" tab at the top or bottom of the page.

> Would you expect none?

As in, would I expect no AI usage? Coz no I absolutely expect people to use AI.

If you had got Claude to do this investigation for you then actually I think that would have been notable enough to include details of your AI workflow. But not because "it's cheating not to disclose it", rather because you'd probably have come up with quite a neat workflow that is interesting in its own right.

I came to these comments coz I was curious about the AI usage here, and FWIW I also thought it smelled AI written, but I didn't think it was slop. (IMO not all AI output is slop and not all slop comes from AI).

My main question was "did Claude do the investigation by itself or just write up the article from someone's notes?"

Also though, I'm quite willing to believe this is human written and the human just happens to have a Claudey style. The actual prose isn't that Claudey it's just the structure of how it presents ideas. But, Claude had to get that structure from somewhere. It's not that surprising to see people with that style of communication.

Hmm yeah that's never really been my read on Auto Mode but I guess it's still worth pushing back on any messaging that seems to imply "Auto Mode is all you need".

I would reject "Auto Mode is safe" as a message but FWIW I am totally on board with "on aggregate, making Auto Mode the default improves the safety of Claude Code compared to the prior status quo". Coz I would say in the vast majority of cases the access classifier is doing a better job than the thing it replaced.

Anyway yeah. Like I said, conclusion is the same: we should be decoupling this from the harness. We ought to be sandboxing agents the same way we sandbox applications. I wish Claude Code would make this path smoother :(

It's funny coz it seemed like they also cloned the confusion.

I don't really understand what Claude Cowork is. Sometimes I use it instead of plain Claude Chat for tasks that "feel big"? And when I've done that I've felt this was the right choice. But until I actually had that session up and running I would not be able to articulate what Cowork is or enumerate any specifics of how I expected it to behave. I just thought "maybe this is a Cowork task?"

(I have only used the cloud one. My understanding is the the local app is essentially Claude Code but for non-coders, which matches the description of the OpenAI equivalent).

Even as someone who's now used it a few times I wouldn't have been able to articulate as many details as Simon W does in this article, it's a weirdly shaped product structure.

Yeah I jumped on this quite excitedly but it's not prompt injection at all.

To be fair to the authors they don't actually say it is. But then they contrast it with the "0.00% prompt injection attack success rate".

The upshot is kinda the same - this is still evidence that we should be sandboxing our agents. But it doesn't actually challenge Anthropic's "our models are too clever to prompt-inject" vibe.

Before I left Google recently there was a document going around called go/stake-your-reputation, basically saying "I'm happy to receive your AI generated code but the condition is that I will judge your capabilities by it, exactly as if you handwrote it, and I'll lower my opinion of you if it's slop (with the implication that if you don't improve I'll stop accepting your contributions)"

I think the term "stake your reputation" is quite good for this situation. I.e. "hi new contributor, please acknowledge that you Stake Your Reputation before we move ahead with this code review".

(Doesn't help with legal aspects of course)

I am, for some reason, quite active commenting on Reddit. And lately the number of comments I see that are obviously Claude has skyrocketed. These are just engaging in normal innocuous comment threads about the day to day stuff I care about (tech, my local region, stuff like that). But obviously they are building organic-looking profiles that can then be exploited to push manipulative content later.

This scares me because the stuff that screams "THIS COMMENT WAS WRITTEN BY CLAUDE" has gotta be the tip of the iceberg. There must be much more of these comments that are better-prompted and using better-tuned model pipelines to make them less detectable. (Probably even just the lazy garbage is harder for me personally to detect if you just pass the prompt to GPT instead of Claude, it's just that I've read so much Claude output that I'm attuned to it).

So yeah suddenly dead internet theory is seeming a lot more real today than it did just a couple of months ago.

It means you can comment on the problematic commits saying "please squash this". Then (if it works as well as Gerrit) you can compare the commit between the before and after squash state.

Basically it lets you treat the commits as part of the thing you are reviewing instead of just a minor detail that the UI doesn't care about very much.

Correct, it was a typo that I only spotted after I lost the ability to edit.

Yeah I get occasional dropouts in the setup I installed at my mum's place too.

And yeah it's just a bit of a weird black box, and also fundamentally it's exploiting a nontrivial system to do something that had little relationships to its design goals. I don't know anything about electrical systems but I assume there is all kinds of random shit that can disrupt Powerline links while still being fully within the design envelope of the power system.

It's a Unifi Dream Router 7. The 6GHz doesn't reach through the wall IIRC

Yeah I was considering this actually, but then I realised that I really want a working LAN 100.0% of the time, so I'd only go tinker mode if I had a backup. So I was gonna be buying a router regardless.

Now I have a Ubiquiti one, it's antithetical to my DIY instincts but I think I'm OK with my router being one of the proprietary appliances in my life.

Plus now the wired section of my LAN is really fast.

My router is slightly loadbearing for my homelab so probably much more often than average!

I recently upgraded from a WiFi 5 router to a WiFi 7 one, and my bandwidth increase was a grand 0% (that's ok though I was actually just sick of my old router's shitty UI!)

There is about 10m and a brick wall between my AP and my desk so yeah, a fancy new MCS that can theoretically deliver 25Gbps was just never gonna be useful to me.

Also I've worked on (other non-WiFi) 802.11 products where our competitive edge was all about interference motivation. Our competitors at trade shows would see the demos and say "that's fake, you guys are cheating". So I have the feeling that in general there might be alpha in more resilient wireless links.

> LLMs are also terrible at these new standards.

This seems like a common enough issue that it would be worthwhile publishing a "Markdown library" of "stuff HTML can do" that you can "call" from your AGENTS.md.

Edit: lol, a sibling commenter shows I am not the first to have this idea! https://developer.chrome.com/docs/modern-web-guidance/get-st...

(They made it a skill, which brings me to another thing I've had on my mind lately: that's annoying if you know when you start the harness that you will want it to read the skill. It's a roundtrip through the model to activate it. But maybe there's a way to fix that?)

(Edit2: Claude says if you activate the skill via /skill-name in the initial prompt, you get what I want)

That's exactly what I am saying. I don't care if it's AI, I care if it's good. But unfortunately because AI makes creating software very cheap, the old signals to tell you if software is good, no longer work.

If you click the link at the top you'll find it goes to an article. The article will often expand upon the text in the link!!!

In this case:

"While we would expect children's lungs to grow year on year, our results indicate that the London children's lung growth had accelerated during the four years to 'catch up' with the control group in Luton to reach similar levels of lung capacity," researchers say.

"I was absolutely stunned when I first saw the results," Prof Chris Griffiths, a senior author on the study, at Queen Mary University of London, told the BBC.

"The speed of catch up in lung capacity in the London group was surprising and impressive."